Threats tagged 'ghsa-4mjw-xr5x-prpc'

Apache ActiveMQ NMS AMQP Client versions up to 2.3.0 contain a critical deserialization of untrusted data vulnerability. This flaw allows malicious AMQP servers to exploit unbounded deserialization logic in the client, potentially leading to arbitrary code execution. Although version 2.1.0 introduced allow/deny list protections, these were bypassable under certain conditions. The issue is resolved in version 2.4.0 and later. Users are advised to upgrade and migrate away from .NET binary serialization for long-term security.