CVE-2026-101292: Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATIONDOWNSTREAMCONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.
Other sources
see https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.6q218rre4ubh#bookmark=id.a4srunl7g7zw for detailed analysis
the unsafe Class.forName() reflection in FederationStreamConnectMessage.getFederationPolicy() is a separate code defect that requires its own fix. the reflection type-check fix landed independently in Artemis 2.34.0 via ARTEMIS-4766. When there is code that still needs to be fixed independently of an existing CVE, a separate CVE is warranted to ensure proper tracking, backporting, and remediation.
Fix status: The upstream fix is delivered in two stages. The primary fix — type validation before instantiation — was released in Artemis 2.34.0 via ARTEMIS-4766. This type check narrows the attack surface to only FederationPolicy implementations (2-3 classes with benign constructors), making exploitation impractical. A complete fix — full removal of the Class.forName() reflection — has been merged to main via ARTEMIS-6067 (2026-05-19) but is not yet released (expected in Artemis 2.55.0). The new CVE fix version should reference Artemis 2.34.0 (ARTEMIS-4766) as the primary fix.
Scored independently (post-auth context, PR:H), the standalone CVSS is 5.5 Medium. However, on products where CVE-2026-27446 is unpatched (e.g., JBoss EAP 7.4 ELS1 — "Will not fix"), this reflection is reachable pre-auth and the combined effective severity is higher.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.34.0Patch ARTEMIS-4766 - Upgrade
Upgrade
Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.55.0Patch ARTEMIS-6067
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache ActiveMQ Artemis deployments before 2.34.0 that accept federation connections are exposed. Exploitation requires an authenticated federation peer.
What does an attacker need to do to exploit it?
The attacker needs to send a FEDERATION_DOWNSTREAM_CONNECT packet containing a crafted class name. The referenced class must be visible to the Artemis module classloader and have side effects in a static initializer or no-argument constructor.
What impact can exploitation have?
Loading and instantiating the attacker-selected visible class occurs before type validation. This can cause denial of service through system-property poisoning or classloading-related memory exhaustion, and may allow broker state manipulation.