deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39735
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

jfs: fix slab-out-of-bounds read in ea_get()

During the "size_check" label in ea_get(), the code checks if the extended
attribute list (xattr) size matches ea_size. If not, it logs
"ea_get: invalid extended attribute" and calls print_hex_dump().

Here, EALIST_SIZE(ea_buf->xattr) returns[PII_REDACTED], which exceeds
INT_MAX (2,147,483,647). Then ea_size is clamped:

	int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr));

Although clamp_t aims to bound ea_size between 0 and[PII_REDACTED], the upper
limit is treated as an int, causing an overflow above 2^31 - 1. This leads
"size" to wrap around and become negative (-184549328).

The "size" is then passed to print_hex_dump() (called "len" in
print_hex_dump()), it is passed as type size_t (an unsigned
type), this is then stored inside a variable called
"int remaining", which is then assigned to "int linelen" which
is then passed to hex_dump_to_buffer(). In print_hex_dump()
the for loop, iterates through 0 to len-1, where len is[PII_REDACTED][PII_REDACTED], calling hex_dump_to_buffer()
on each iteration:

	for (i = 0; i < len; i += rowsize) {
		linelen = min(remaining, rowsize);
		remaining -= rowsize;

		hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize,
				   linebuf, sizeof(linebuf), ascii);

		...
	}

The expected stopping condition (i < len) is effectively broken
since len is corrupted and very large. This eventually leads to
the "ptr+i" being passed to hex_dump_to_buffer() to get closer
to the end of the actual bounds of "ptr", eventually an out of
bounds access is done in hex_dump_to_buffer() in the following
for loop:

	for (j = 0; j < len; j++) {
			if (linebuflen < lx + 2)
				goto overflow2;
			ch = ptr[j];
		...
	}

To fix this we should validate "EALIST_SIZE(ea_buf->xattr)"
before it is utilised.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/0beddc2a3f9b9cf7d[PII_REDACTED]e36c2d0fa3652; https://git.kernel.org/stable/c/16d3d36436492aa248b2d8045e75585ebcc2f34d; https://git.kernel.org/stable/c/3d6fd5b9c6acbc005e53d0211c7381f566babec1
CVE: CVE-2025-39755
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: gpib: Fix cb7210 pcmcia Oops

The  pcmcia_driver struct was still only using the old .name
initialization in the drv field. This led to a NULL pointer
deref Oops in strcmp called from pcmcia_register_driver.

Initialize the pcmcia_driver struct name field.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/7ec50077d7f6647cb6ba3a2a20a6c26f51259c7d; https://git.kernel.org/stable/c/c1baf6528bcfd6a86842093ff3f8ff8caf309c12; https://git.kernel.org/stable/c/c82ae06f49e70d1c14ee9c76c392345856d050c9
CVE: CVE-2025-39778
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()

The csts_state_names[] array only has six sparse entries, but the
iteration code in nvmet_ctrl_state_show() iterates seven, resulting in a
potential out-of-bounds stack read.  Fix that.

Fixes the following warning with an UBSAN kernel:

  vmlinux.o: warning: objtool: .text.nvmet_ctrl_state_show: unexpected end of section
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/0cc0efc58d6c741b2868d4af24874d7fec28a575; https://git.kernel.org/stable/c/107a23185d990e3df6638d9a84c835f963fe30a6; https://git.kernel.org/stable/c/1adc93a525fdee8e2b311e6d5fd93eb69714ca05
CVE: CVE-2025-39930
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()

commit 419d1918105e ("ASoC: simple-card-utils: use __free(device_node) for
device node") uses __free(device_node) for dlc->of_node, but we need to
keep it while driver is in use.

Don't use __free(device_node) in graph_util_parse_dai().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/146e25625378f7d4463acbd1ffbd975f3332a806; https://git.kernel.org/stable/c/16a49e3fda339aa552cde7f2cdbb25b91426cb8a; https://git.kernel.org/stable/c/232a32e8a7e9be8a2ee238df9b5304eed2f4e195
CVE: CVE-2025-40014
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()

If speed_hz < AMD_SPI_MIN_HZ, amd_set_spi_freq() iterates over the
entire amd_spi_freq array without breaking out early, causing 'i' to go
beyond the array bounds.

Fix that by stopping the loop when it gets to the last entry, so the low
speed_hz value gets clamped up to AMD_SPI_MIN_HZ.

Fixes the following warning with an UBSAN kernel:

  drivers/spi/spi-amd.o: error: objtool: amd_set_spi_freq() falls through to next function amd_spi_set_opcode()
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/76e51db43fe4aaaebcc5ddda67b0807f7c9bdecc; https://git.kernel.org/stable/c/7f2c746e09a3746bf937bc708129dc8af61d8f19
CVE: CVE-2025-40114
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: light: Add check for array bounds in veml6075_read_int_time_ms

The array contains only 5 elements, but the index calculated by
veml6075_read_int_time_index can range from 0 to 7,
which could lead to out-of-bounds access. The check prevents this issue.

Coverity Issue
CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array veml6075_it_ms of 5 4-byte
elements at element index 7 (byte offset 31) using
index int_index (which evaluates to 7)

This is hardening against potentially broken hardware. Good to have
but not necessary to backport.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/18a08b5632809faa671279b3cd27d5f96cc5a3f0; https://git.kernel.org/stable/c/7a40b52d4442178bee0cf1c36bc450ab951cef0f; https://git.kernel.org/stable/c/9c40a68b7f97fa487e6c7e67fcf4f846a1f96692
CVE: CVE-2025-40325
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

md/raid10: wait barrier before returning discard request with REQ_NOWAIT

raid10_handle_discard should wait barrier before returning a discard bio
which has REQ_NOWAIT. And there is no need to print warning calltrace
if a discard bio has REQ_NOWAIT flag. Quality engineer usually checks
dmesg and reports error if dmesg has warning/error calltrace.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/31d3156efe909b53ba174861a3da880c688f5edc; https://git.kernel.org/stable/c/31ff67982c5fa39c0093b9d9f429fef91c2494b7; https://git.kernel.org/stable/c/3db[PII_REDACTED]a345431b45f57876a3df133f3b4
CVE: CVE-2025-2492
Published: 2025-04-18
Description: An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions.


Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
CWE: CWE-288
References: https://www.asus.com/content/asus-product-security-advisory/
CVE: CVE-2025-3056
Published: 2025-04-18
Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3275196/; https://wordpress.org/plugins/download-manager/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/dd9e6ba7-f107-4d7c-a7da-35e603f3a1a8?source=cve
CVE: CVE-2025-3785
Published: 2025-04-18
Description: A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121
References: https://github.com/ZOKEYE/CVE/blob/main/D-link.md; https://vuldb.com/?ctiid.305608; https://vuldb.com/?id.305608
CVE: CVE-2025-3786
Published: 2025-04-18
Description: A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-120
References: https://github.com/CH13hh/cve/tree/AC15WifiExtraSet; https://vuldb.com/?ctiid.305609; https://vuldb.com/?id.305609
CVE: CVE-2025-3106
Published: 2025-04-18
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/assets/js/addons/tablet-contents.min.js; https://plugins.trac.wordpress.org/changeset/3275257/; https://wordpress.org/plugins/lastudio-element-kit/#developers
CVE: CVE-2025-3787
Published: 2025-04-18
Description: A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.7 (LOW)
CWE: CWE-918
References: https://github.com/KKDT12138/CVE/blob/main/cve6.pdf; https://vuldb.com/?ctiid.305610; https://vuldb.com/?id.305610
CVE: CVE-2025-3788
Published: 2025-04-18
Description: A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/sys/user/save. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/JSite/XSS1.md; https://vuldb.com/?ctiid.305611; https://vuldb.com/?id.305611
CVE: CVE-2024-45651
Published: 2025-04-18
Description: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 

does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-613
References: https://www.ibm.com/support/pages/node/7231178
CVE: CVE-2024-49808
Published: 2025-04-18
Description: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://www.ibm.com/support/pages/node/7231180
CVE: CVE-2024-46089
Published: 2025-04-18
Description: 74cms <=3.33 is vulnerable to remote code execution (RCE) in the background interface apiadmin.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://gitee.com/Q16G/laravel_bug/blob/master/74cms.md; https://github.com/Q16G/cve_detail/blob/main/74cms/unzipRCE.md
CVE: CVE-2025-32790
Published: 2025-04-18
Description: Dify is an open-source LLM app development platform. In versions 0.6.8 and prior, a vulnerability was identified in the DIFY AI where normal users are improperly granted permissions to export APP DSL. The feature in '/export' should only allow administrator users to export DSL. A workaround for this vulnerability involves updating the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can export the APP DSL. This vulnerability is fixed in 0.6.13.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/langgenius/dify/commit/59ad091e69736bc9dc1a3bace62ec0a232346246; https://github.com/langgenius/dify/pull/5841; https://github.com/langgenius/dify/security/advisories/GHSA-jp6m-v4gw-5vgp
CVE: CVE-2025-3789
Published: 2025-04-18
Description: A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/save. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/caigo8/CVE-md/blob/main/JSite/XSS3.md; https://vuldb.com/?ctiid.305612; https://vuldb.com/?id.305612
CVE: CVE-2025-3790
Published: 2025-04-18
Description: A vulnerability classified as critical has been found in baseweb JSite 1.0. This affects an unknown part of the file /druid/index.html of the component Apache Druid Monitoring Console. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/caigo8/CVE-md/blob/main/JSite/durid%E6%9C%AA%E6%8E%88%E6%9D%83.md; https://vuldb.com/?ctiid.305613; https://vuldb.com/?id.305613
CVE: CVE-2024-11421
Published: 2025-04-18
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: The developer has disputed this as a vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-40364
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix io_req_prep_async with provided buffers

io_req_prep_async() can import provided buffers, commit the ring state
by giving up on that before, it'll be reimported later if needed.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/233b210a678bddf8b49b02a070074a52b87e6d43; https://git.kernel.org/stable/c/35ae7910c349fb3c60439992e2e0e79061e95382; https://git.kernel.org/stable/c/a1b17713b32c75a90132ea2f92b1257f3bbc20f3
CVE: CVE-2024-29643
Published: 2025-04-18
Description: An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-444
References: https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574; https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574
CVE: CVE-2025-28228
Published: 2025-04-18
Description: A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228
CVE: CVE-2025-28229
Published: 2025-04-18
Description: Incorrect access control in Orban OPTIMOD 5950 Firmware v1.0.0.2 and System v2.2.15 allows attackers to bypass authentication and gain Administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28229; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28229
CVE: CVE-2025-28230
Published: 2025-04-18
Description: Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28230; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28230
CVE: CVE-2025-28232
Published: 2025-04-18
Description: Incorrect access control in the HOME.php endpoint of JMBroadcast JMB0150 Firmware v1.0 allows attackers to access the Admin panel without authentication.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28232; https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28232
CVE: CVE-2025-29209
Published: 2025-04-18
Description: TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/LZY0522/CVE/blob/main/X18-sub_41105c.md; https://github.com/LZY0522/CVE/blob/main/X18-sub_41105c.md
CVE: CVE-2025-29625
Published: 2025-04-18
Description: A buffer overflow vulnerability in Astrolog v7.70 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via an overly long environment variable passed to FileOpen function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://blog.reodus.com/posts/cve-2025-29625/; https://github.com/CruiserOne/Astrolog/issues/25
CVE: CVE-2025-2950
Published: 2025-04-18
Description: IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-644
References: https://www.ibm.com/support/pages/node/7231320
CVE: CVE-2025-37838
Published: 2025-04-18
Description: In the Linux kernel, the following vulnerability has been resolved:

HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition

In the ssi_protocol_probe() function, &ssi->work is bound with
ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
within the ssip_pn_ops structure is capable of starting the
work.

If we remove the module which will call ssi_protocol_remove()
to make a cleanup, it will free ssi through kfree(ssi),
while the work mentioned above will be used. The sequence
of operations that may lead to a UAF bug is as follows:

CPU0                                    CPU1

                        | ssip_xmit_work
ssi_protocol_remove     |
kfree(ssi);             |
                        | struct hsi_client *cl = ssi->cl;
                        | // use ssi

Fix it by ensuring that the work is canceled before proceeding
with the cleanup in ssi_protocol_remove().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4a8c29beb8a02b5a0a9d77d608aa14b6f88a6b86; https://git.kernel.org/stable/c/4b4194c9a7a8f92db39e8e86c85f4fb12ebbec4f; https://git.kernel.org/stable/c/58eb29dba712ab0f13af59ca2fe545f5ce360e78
CVE: CVE-2025-3791
Published: 2025-04-18
Description: A vulnerability classified as critical was found in symisc UnQLite up to 957c377cb691a4f617db9aba5cc46d90425071e2. This vulnerability affects the function jx9MemObjStore of the file /data/src/benchmarks/unqlite/unqlite.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-122
References: https://github.com/symisc/unqlite/issues/173; https://github.com/user-attachments/files/19652580/unqlite-reproduce-heap-overflow.zip; https://vuldb.com/?ctiid.305614
CVE: CVE-2025-3792
Published: 2025-04-18
Description: A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/FSRM1/CVE/blob/main/seacms_sql%E6%B3%A8%E5%85%A5.md; https://vuldb.com/?ctiid.305615; https://vuldb.com/?id.305615
CVE: CVE-2025-27599
Published: 2025-04-18
Description: Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-926
References: https://github.com/element-hq/element-x-android/commit/dc058544d7e693c04298191c1aadd5b39c9be52e; https://github.com/element-hq/element-x-android/releases/tag/v25.04.2; https://github.com/element-hq/element-x-android/security/advisories/GHSA-m5px-pwq3-4p5m
CVE: CVE-2025-29784
Published: 2025-04-18
Description: NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and potential denial-of-service (DoS) attacks. This issue has been patched in version 2.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-130, CWE-1284
References: https://github.com/NamelessMC/Nameless/commit/f5341e56930a98978171e0a871d60f19ab30ebdd; https://github.com/NamelessMC/Nameless/releases/tag/v2.2.0; https://github.com/NamelessMC/Nameless/security/advisories/GHSA-4hrq-rf96-c2jm
CVE: CVE-2025-29953
Published: 2025-04-18
Description: Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.

This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed.

The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether.

Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://lists.apache.org/thread/vc1sj9y3056d3kkhcvrs9fyw5w8kpmlx; http://www.openwall.com/lists/oss-security/2025/04/18/3