CVE-2026-101292 Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
An authenticated federation peer can trigger unsafe reflection in ActiveMQ Artemis, leading to arbitrary class instantiation and potential denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-101292?
CVE-2026-101292 is a high-severity unsafe deserialization vulnerability in Red Hat AMQ Broker 7, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.
Weakness: CWE-470
Which versions are affected by CVE-2026-101292?
How do I fix CVE-2026-101292?
No fix has been published for CVE-2026-101292 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-101292 being exploited?
There is no known exploitation of CVE-2026-101292 in the wild and no public exploit code.
Sources
Also known as GHSA-226w-4p8p-xh2w.