{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57822", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-06-25T13:00:37.878Z", "datePublished": "2026-09-10T04:46:52.192Z", "dateUpdated": "2026-09-10T05:11:46.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-10T04:46:52.192Z"}, "title": "Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.artemis:artemis-core-client", "packageURL": "pkg:maven/org.apache.artemis/artemis-core-client", "versions": [{"status": "affected", "version": "2.50.0", "lessThanOrEqual": "2.56.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache ActiveMQ Artemis", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.activemq:artemis-core-client", "packageURL": "pkg:maven/org.apache.activemq/artemis-core-client", "versions": [{"status": "affected", "version": "1.3.0", "lessThanOrEqual": "2.44.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.\n\n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.<br></p><p><span>This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.</span></p><p>Users are recommended to upgrade to version 2.57.0, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/0jmovbbvdo22zq1r91jrlhv02ck7jqzp", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Clebert Suconic", "type": "finder"}, {"lang": "en", "value": "Mike Read", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/10/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-10T05:11:46.447Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.artemis:artemis-core-client", "packageURL": "pkg:maven/org.apache.artemis/artemis-core-client", "product": "Apache Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.56.0", "status": "affected", "version": "2.50.0", "versionType": "semver"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.activemq:artemis-core-client", "packageURL": "pkg:maven/org.apache.activemq/artemis-core-client", "product": "Apache ActiveMQ Artemis", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.44.0", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.\n\n\n\n\nThis issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.\n\n\n\nUsers are recommended to upgrade to version 2.57.0, which fixes the issue."}], "id": "CVE-2026-57822", "lastModified": "2026-09-10T06:17:05.473", "metrics": {}, "published": "2026-09-10T05:17:01.343", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread/0jmovbbvdo22zq1r91jrlhv02ck7jqzp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/09/10/4"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received"}

{"bugzilla": {"description": "artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address", "id": "2495823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495823"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray() method\nuses ObjectInputStream.readObject() to deserialize CompositeData from Base64-encoded\nserialized objects in management message bodies sent to the activemq.management\naddress. While the deserialization is protected by an allowlist\n(java.util,java.lang,javax.management) that blocks RCE gadget chains, an\nauthenticated attacker with the MANAGE role can craft a deserialization bomb using\ndeeply nested java.util.HashSet/HashMap structures to exhaust CPU/memory and crash\nthe broker JVM, causing denial of service for all connected clients."], "mitigation": {"lang": "en:us", "value": "Restrict MANAGE role access: ensure only trusted administrative accounts have the manage permission on the activemq.management address. Review security-setting configurations in standalone-full.xml (EAP) or broker.xml (AMQ Broker) to confirm management address role assignments follow least-privilege principles. Additionally, restrict network access to messaging ports (default 61616) so that management operations are only accessible from administrative networks."}, "name": "CVE-2026-57822", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "artemis-core-client", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "artemis-core-client", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "artemis-core-client", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "artemis-core-client", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "artemis-core-client", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "artemis-core-client", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "artemis-core-client", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-09-10T05:47:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57822\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57822\nhttps://github.com/apache/activemq-artemis/blob/2.16.0/artemis-core-client/src/main/java/org/apache/activemq/artemis/api/core/JsonUtil.java"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.0,2.44.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache ActiveMQ Artemis", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "activemq_artemis", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.50.0,2.56.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Artemis", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "artemis", "vendor": "apache"}], "created": "2026-09-10T06:30:05.252744+00:00", "updated": "2026-09-10T11:30:06.673857+00:00", "vendors": ["apache", "apache$PRODUCT$activemq_artemis", "apache$PRODUCT$artemis"], "weaknesses": ["CWE-502", "CWE-400"]}