CVE-2015-5254 — Improper Input Validation in...
Improper Input Validation in Apache ActiveMQ
Summary
Advisory Timeline
- First published May 13, 2022 (1613 days ago).
- Last revised February 21, 2024 — 649 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
<!-- Update pom.xml dependency version to 5.12.2 for org.apache.activemq:activemq-client -->
<!-- Update pom.xml dependency version to 5.11.3 for org.apache.activemq:activemq-client -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: maven (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.activemq:activemq-client | maven | 5.12.0, 5.12.1 | 5.12.2 |
| org.apache.activemq:activemq-client | maven | 5.10.0, 5.10.1, 5.10.2, 5.11.0 (+5 more) | 5.11.3 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-20Improper Input ValidationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-5254ADVISORY
- https://github.com/apache/activemq/commit/6f03921b31d9fefeddb0f4fa63150ed1f94a14bWEB
- https://github.com/apache/activemq/commit/73a0caf758f9e4916783a205c7e422b4db27905WEB
- https://github.com/apache/activemq/commit/7eb9b218b2705cf9273e30ee2da026e43b6dd4eWEB
- https://github.com/apache/activemq/commit/e7a4b53f799685e337972dd36ba0253c04bcc01WEB
- https://github.com/apache/activemqWEB
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680WEB
- https://issues.apache.org/jira/browse/AMQ-6013WEB
- https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2@%3Ccommits.activemq.apache.org%3EWEB
- https://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txtWEB
- https://lists.fedoraproject.org/pipermail/package-announce/2015-December/174371.htmlWEB
- https://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.htmlWEB
- https://rhn.redhat.com/errata/RHSA-2016-0489.htmlWEB
- https://rhn.redhat.com/errata/RHSA-2016-2035.htmlWEB
- https://rhn.redhat.com/errata/RHSA-2016-2036.htmlWEB
- https://www.debian.org/security/2016/dsa-3524WEB
- https://www.openwall.com/lists/oss-security/2015/12/08/6WEB
- https://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlWEB
- https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlWEB
Frequently Asked Questions
- What is CVE-2015-5254?
- Improper Input Validation in Apache ActiveMQ This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2015-5254?
- CVE-2015-5254 affects org.apache.activemq:activemq-client. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2015-5254 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2014-3600CRITICAL
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
- CVE-2023-46604CRITICAL
Apache ActiveMQ is vulnerable to Remote Code Execution
- CVE-2026-39304HIGH
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
- CVE-2026-42588HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
- CVE-2026-41044HIGH
Apache ActiveMQ Vulnerable to Code Injection
- CVE-2026-45505HIGH
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
- CVE-2026-40466HIGH
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
- CVE-2025-27533MEDIUM
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies