CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Artemis / Apache ActiveMQ Artemisto a version that resolves this vulnerability.Fixed in 2.57.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated messaging client with MANAGE permission and authorization to perform management-via-messaging. Clients without those privileges are not described as able to trigger the vulnerable parameter processing.
Are brokers affected by default?
The issue is triggered only while processing message-based management requests. The provided information does not establish whether a default Artemis or ActiveMQ Artemis configuration grants clients the required MANAGE and management-via-messaging permissions.
What is the impact of a successful exploit?
A crafted permitted parameter type can cause excessive computation and pin a broker processing thread. This can lead to denial of service.
What should be done if an immediate upgrade is not possible?
Restrict MANAGE permission and management-via-messaging authorization to only trusted, necessary authenticated clients. This reduces access to the request path required to trigger the issue.
Which versions require remediation?
Apache Artemis versions 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis versions 1.3.0 through 2.44.0 are affected. Upgrade to version 2.57.0 as recommended.