Remote code execution via unbounded response deserialization

Deserialization in Apache ActiveMQ NMS AMQP Client 2.3.0 and earlier allows remote attackers to execute code through malicious server responses. When a client connects to an untrusted AMQP server, its binary deserialization path processes attacker-controlled response objects without enforceable bounds; the allow/deny-list restriction introduced in 2.1.0 can be bypassed. Exploitation requires the application to initiate an AMQP connection to an attacker-controlled server and results in arbitrary code execution in the client process.