Описание
A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray() method uses ObjectInputStream.readObject() to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an allowlist (java.util,java.lang,javax.management) that blocks RCE gadget chains, an authenticated attacker with the MANAGE role can craft a deserialization bomb using deeply nested java.util.HashSet/HashMap structures to exhaust CPU/memory and crash the broker JVM, causing denial of service for all connected clients.
Меры по смягчению последствий
Restrict MANAGE role access: ensure only trusted administrative accounts have the manage permission on the activemq.management address. Review security-setting configurations in standalone-full.xml (EAP) or broker.xml (AMQ Broker) to confirm management address role assignments follow least-privilege principles. Additionally, restrict network access to messaging ports (default 61616) so that management operations are only accessible from administrative networks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | artemis-core-client | Not affected | ||
| Red Hat Fuse 7 | artemis-core-client | Out of support scope | ||
| Red Hat JBoss Enterprise Application Platform 7 | artemis-core-client | Will not fix | ||
| Red Hat JBoss Enterprise Application Platform 8 | artemis-core-client | Affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | artemis-core-client | Affected | ||
| Red Hat Single Sign-On 7 | artemis-core-client | Not affected | ||
| Red Hat AMQ Broker 7.13.6 | artemis-core-client | Fixed | RHSA-2026:66545 | 10.09.2026 |
| Red Hat AMQ Broker 7.14.1 | artemis-core-client | Fixed | RHSA-2026:66488 | 10.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.9 Medium
CVSS3
Связанные уязвимости
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
EPSS
4.9 Medium
CVSS3