CVE-2026-57822 Deserialization in Apache ActiveMQ Artemis

Medium 6.5 Published 10 Sep 2026 Updated 10 Sep 2026

An authenticated user with management permissions can cause denial of service by sending crafted messages that trigger excessive computation during parameter deserialization.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-57822?

CVE-2026-57822 is a medium-severity unsafe deserialization vulnerability in Apache ActiveMQ Artemis, published on 10 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.

This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.

Users are recommended to upgrade to version 2.57.0, which fixes the issue.

Weakness: CWE-502

Which versions are affected by CVE-2026-57822?

It affects 1 product.

Products include Apache Artemis.

How do I fix CVE-2026-57822?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-57822 being exploited?

There is no known exploitation of CVE-2026-57822 in the wild and no public exploit code.

Sources

Also known as GHSA-73q3-xq4g-44wj.