CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service
Apache fixed CVE-2026-57822, a deserialization flaw in ActiveMQ Artemis management messaging letting authorized clients trigger broker denial of service.
Apache disclosed a deserialization issue in message-based management request handling for Apache Artemis and Apache ActiveMQ Artemis. It affects Apache Artemis (artemis-core-client) 2.50.0 through 2.56.0 and ActiveMQ Artemis (artemis-core-client) 1.3.0 through 2.44.0. Exploitation requires an authenticated client authorized with MANAGE permission using management-via-messaging; parameter processing can trigger denial of service. Apache rates the issue as important.
- Affects Artemis core-client 2.50.0-2.56.0 and ActiveMQ Artemis 1.3.0-2.44.0
- Requires authenticated client with MANAGE permission via management messaging
- Parameter deserialization in management requests can cause broker denial of service
- Rated important by the Apache Security Team
- CVEs
- CVE-2026-57822
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-57822 | Authenticated deserialization DoS in Apache ActiveMQ Artemis brokers | 6.5 | <1% |
From the original article
Posted by Clebert Suconic on Sep 09 Severity: important Affected versions: - Apache Artemis (org. apache. artemis:artemis-core-client) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.