SB2025101202 - Multiple Apache ActiveMQ vulnerabilities in RSA Governance and Lifecycle

Security Bulletin ID SB2025101202

Severity

Medium

Patch available

NO

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect Regular Expression (CVE-ID: CVE-2022-22950)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due improper input validation when processing SpEL expressions. A remote attacker can send a specially crafted HTTP request to the affected application and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2025-27533)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources during unmarshalling of OpenWire commands. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

https://community.rsa.com/s/article/RSA-2025-10-RSA-Governance-and-Lifecycle-Product-Security-Update-for-ActiveMQ-Vulnerability