CVE-2026-57822

When an Apache Artemis or Apache ActiveMQ Artemis broker processes message-based management requests, it deserializes certain method parameters—including ones the broker does not actually use—and the permitted types can be abused to craft a payload that forces excessive computation, pinning the processing thread and causing a denial of service. Triggering the flaw requires an authenticated messaging client that is authorized with the MANAGE permission to perform management-via-messaging, so anonymous or unprivileged clients cannot exploit it. An attacker with such access can repeatedly submit crafted management messages to tie up broker processing capacity, degrading or blocking message handling. Affected deployments run Apache ActiveMQ Artemis 1.3.0 through 2.44.0 or Apache Artemis 2.50.0 through 2.56.0; the fix ships in version 2.57.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue has not yet been scored under CVSS.

What to do: Upgrade to Apache Artemis 2.57.0, which fixes the issue. As an interim measure, audit which messaging users hold the MANAGE permission for management-via-messaging, restrict it to strictly trusted clients, and disable management-via-messaging on brokers that do not use the feature. Monitor broker processing threads for long-running, CPU-bound management-message handling as a sign of attempted abuse.