CVE-2026-101292: Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-10-20
Weakness: CWE-470

Description

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Affected products

Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: all versions — fixed in 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-101292 or the next vulnerability affects your stack