CVE-2019-0187: Unauthenticated Remote Code Execution in Apache JMeter
Summary
CVE-2019-0187: Unauthenticated Remote Code Execution in Apache JMeter. Affects org.apache.jmeter:ApacheJMeter versions < 5.1. Fixed in 5.1. How to fix ↓
Also tracked for
- jakarta-jmeter · Debian:11
The same CVE-2019-0187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JMeter is an open-source load testing tool used for analyzing and measuring the performance of web applications. It allows users to simulate various scenarios and test the application's ability to handle different loads. JMeter can be run in distributed mode, where multiple instances of JMeter called 'jmeter-servers' are used to distribute the load across different machines. However, prior to version 5.1, JMeter did not encrypt traffic between the nodes or authenticate the participating nodes, making it vulnerable to unauthenticated remote code execution (RCE) attacks.
Vulnerability Detail
The vulnerability (CVE-2019-0187) allows an attacker to establish a Remote Method Invocation (RMI) connection to a jmeter-server using the RemoteJMeterEngine. By exploiting untrusted data deserialization, the attacker can execute arbitrary code on the target system. This vulnerability only affects tests running in Distributed mode. It is important to note that versions before 4.0 are also susceptible to this vulnerability. The impact of this vulnerability is critical, as an attacker can gain unauthorized access to the system and potentially compromise its integrity and confidentiality.
How To Fix
Latest published version: 5.6.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to avoid using JMeter in distributed mode (-r or -R command line options). By running JMeter in standalone mode, the vulnerability can be mitigated. However, this workaround may not be suitable for scenarios where distributed load testing is required.
Conclusion
The unauthenticated remote code execution vulnerability in Apache JMeter (CVE-2019-0187) poses a critical risk to systems running JMeter in distributed mode. Upgrading to version 5.1 or later is strongly advised to secure the distributed mode by enabling encryption and authentication. Alternatively, running JMeter in standalone mode can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jmeter:ApacheJMeter →
FAQ
Apache JMeter is an open-source load testing tool used for analyzing and measuring the performance of web applications.
The vulnerability allows unauthenticated remote code execution, enabling an attacker to execute arbitrary code on the target system. This can lead to unauthorized access, compromising the system's integrity and confidentiality.
Versions before 4.0 are also vulnerable to this unauthenticated remote code execution vulnerability. It is recommended to upgrade to version 5.1 or later.
Yes, a workaround is to avoid using JMeter in distributed mode (-r or -R command line options) and run it in standalone mode. However, this may not be suitable for scenarios requiring distributed load testing.
To fix this vulnerability, it is recommended to upgrade to Apache JMeter version 5.1 or later. The newer versions include encryption of traffic between nodes and authentication of participating nodes, mitigating the risk of unauthenticated RCE attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jmeter:ApacheJMeter.
