CVE-2026-101292

Overview

Apache ActiveMQ Artemis is an open-source, high-performance message broker and the next-generation broker of the Apache ActiveMQ project. It provides asynchronous messaging with a non-blocking, journal-backed core and supports multiple wire protocols and APIs, including AMQP 1.0, MQTT, STOMP, OpenWire, and Jakarta Messaging (JMS). Broker and client components are published as Maven artifacts under org.apache.activemq through 2.44.0 and under org.apache.artemis from 2.50.0.

A resource injection vulnerability (CVE-2026-101292) has been identified in the CORE protocol federation message handling of Apache ActiveMQ Artemis, which allows attackers to make the broker load and instantiate arbitrary classes visible to its classloader. Static initializers and no-argument constructors run as a side effect, which can lead to denial of service or manipulation of broker state.

Per OWASP: This attack consists of changing resource identifiers used by an application in order to perform a malicious task.

This issue affects Apache ActiveMQ Artemis versions before 2.34.0.

Details

Module Info

• Product: Apache ActiveMQ Artemis
• Affected packages: org.apache.activemq:artemis-core-client
• Affected versions: <2.34.0
• GitHub repository: https://github.com/apache/artemis
• Published packages: https://central.sonatype.com/artifact/org.apache.activemq/artemis-core-client
• Package manager: Maven
• Fixed in:
• OSS Apache ActiveMQ Artemis 2.34.0
• NES for Apache ActiveMQ Artemis v2.19.5

Vulnerability Info

This High-severity vulnerability is found in the org.apache.activemq:artemis-core-client package in Apache ActiveMQ Artemis versions before 2.34.0. When the broker receives a FEDERATION_DOWNSTREAM_CONNECT packet over the CORE protocol, the packet decoder builds a FederationDownstreamConnectMessage, and FederationStreamConnectMessage.decodeRest() reads one class name per federation policy straight from the wire buffer and passes it to getFederationPolicy():

int policySize = buffer.readInt();
for (int i = 0; i < policySize; i++) {
   String clazz = buffer.readString();
   FederationPolicy policy = getFederationPolicy(clazz);
   policy.decode(buffer);
   federationPolicyMap.put(policy.getName(), policy);
}

private FederationPolicy getFederationPolicy(String clazz) {
   try {
      return (FederationPolicy) Class.forName(clazz).getConstructor((Class<?>[]) null).newInstance();
   } catch (Exception e) {
      throw new IllegalStateException("Error. Unable to instantiate FederationPolicy: " + e.getMessage(), e);
   }
}

The class name is never checked against the expected FederationPolicy type before it is loaded and constructed. Class.forName initializes the named class, running its static initializer, and newInstance() then runs its public no-argument constructor. Both happen before the cast to FederationPolicy fails, so the exception that follows does not undo their side effects. A federation peer that sends a crafted class name can therefore trigger the initialization and construction of any class visible to the Artemis module classloader, which can be used to poison system properties, exhaust memory through classloading, or otherwise alter broker state.

Mitigation

Only recent versions of Apache ActiveMQ Artemis are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache ActiveMQ Artemis to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.