REDHAT-BUG-2495823: Medium severity Apache ActiveMQ Artemis vulnerability

Published Jul 1, 2026

Updated

Upstream report: CVE-2026-57822 reserved by Apache Security. Reporter: Clebert Suconic (Apache Artemis committer) via PSIRTSUPT-18814.

Vulnerable class: org.apache.activemq.artemis.api.core.JsonUtil.fromJsonArray() Vulnerable JAR: artemis-core-client Affected versions: Artemis 2.16.0 through main (unfixed)

Attack requires MANAGE role (high-privilege administrative permission). Impact: DoS only (deserialization bomb). No RCE or data exfiltration. Allowlist (java.util,java.lang,javax.management) blocks URLDNS and all known RCE gadget chains.

Fix: Upstream plans to disallow JsonUtil from performing server-side deserialization. JsonUtil was only intended for client-side management console browsing.

Cross-reference: This is the same issue as IBM EAP report Medium Finding jboss-eap38.md.

Affected Software

1 affected component

Apache ActiveMQ Artemis>=2.16.0

Event History

Jul 1, 2026

Data Sourced

via Red Hat·04:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs the MANAGE role, which is a high-privilege administrative permission. It is therefore primarily relevant where administrative credentials or access to management functions could be abused.

What is the expected impact of successful exploitation?

The reported impact is denial of service through a deserialization bomb. The report states that remote code execution and data exfiltration are not expected.

Are known deserialization gadget chains usable?

The documented allowlist permits java.util, java.lang, and javax.management classes and blocks URLDNS and all known remote-code-execution gadget chains.

Which component and versions are affected?

The vulnerable method is org.apache.activemq.artemis.api.core.JsonUtil.fromJsonArray() in the artemis-core-client JAR. The report identifies Artemis versions from 2.16.0 through main as affected and unfixed.

What remediation is planned if an update is not yet available?

Upstream plans to prevent JsonUtil from performing server-side deserialization. Until that change is available, restrict the MANAGE role to trusted administrators and protect access to management functions.

REDHAT-BUG-2495823: Medium severity Apache ActiveMQ Artemis vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the expected impact of successful exploitation?

Are known deserialization gadget chains usable?

Which component and versions are affected?

What remediation is planned if an update is not yet available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the expected impact of successful exploitation?

Are known deserialization gadget chains usable?

Which component and versions are affected?

What remediation is planned if an update is not yet available?