CVE-2015-5254: Apache ActiveMQ

Critical severity, CVSS 9.8. EPSS: 38.2% chance of exploitation in the next 30 days.

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Affected products

• Apache ActiveMQ: version 5.0.0 only; version 5.1.0 only; version 5.2.0 only; version 5.3.0 only; version 5.3.1 only; version 5.3.2 only; …
• Fedoraproject Fedora: version 22 only; version 23 only
• Red Hat Openshift: version 2.0 only

Published 2016-01-08. Last modified 2026-06-17.