CVE-2025-27533
HIGHApache ActiveMQ 5.16.0-5.16.7, 5.17.0-5.17.6, 5.18.0-5.18.6 - Denial of Service via OpenWire Buffer Size Validation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-27533. PoCs published by Abdualhadi khalifa, absholi7ly.
AI-analyzed exploit summary This exploit targets CVE-2025-27533, a DoS vulnerability in Apache ActiveMQ 6.1.6. It sends maliciously crafted packets with large buffer sizes to overwhelm the server, causing a denial of service.
Description
Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections. This issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected. Users are recommended to upgrade to version 6.1.6+, 5.19.0+, 5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue. Existing users may implement mutual TLS to mitigate the risk on affected brokers.
Exploits (2)
This exploit targets CVE-2025-27533, a DoS vulnerability in Apache ActiveMQ 6.1.6. It sends maliciously crafted packets with large buffer sizes to overwhelm the server, causing a denial of service.
This is a functional DoS exploit for CVE-2025-27533 targeting Apache ActiveMQ. It sends maliciously crafted packets with large buffer sizes to trigger a denial-of-service condition.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H