PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-101292 Red Hat CVE debrief

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader.

Vendor
Red Hat
Product
Red Hat JBoss Enterprise Application Platform 7.4.25
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-28
Original CVE updated
2026-10-20
Advisory published
2026-09-28
Advisory updated
2026-10-20

Who should care

Defenders responsible for Apache ActiveMQ Artemis deployments, particularly those using Federation features, should assess exposure and apply remediation to prevent potential denial of service or broker state manipulation.

Why it matters

CVE-2026-101292 is a high-severity vulnerability in Apache ActiveMQ Artemis that allows authenticated federation peers to cause denial of service or broker state manipulation. Defenders should verify exposure, restrict access, and apply vendor remediation.

  • Denial of service via system-property poisoning
  • Out-of-memory conditions via classloading
  • Broker state manipulation via crafted class instantiation

Technical summary

The vulnerability allows an authenticated federation peer to send a crafted FEDERATION_DOWNSTREAM_CONNECT packet, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader, potentially leading to denial of service or broker state manipulation. This could result in system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation via crafted class instantiation. Defenders should assess exposure and apply remediation to prevent potential denial of service or broker state manipulation.

Defensive priority

Defenders should prioritize verifying exposure of Artemis module classloaders, restricting access to authenticated federation peers, and applying vendor remediation.

Recommended defensive actions

  • Verify exposure of Artemis module classloaders to authenticated federation peers
  • Restrict access to authenticated federation peers
  • Apply vendor remediation by upgrading to Apache ActiveMQ Artemis 2.34.0 or later
  • Monitor for suspicious FEDERATION_DOWNSTREAM_CONNECT packets
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official metadata and vulnerability assessment. Red Hat provides supplemental source references for technical description and vendor advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-101292 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-101292

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-101292 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-101292

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserializa

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/101xxx/CVE-2026-101292.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:53644

    Supplemental source - technical-description, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:53806

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-101292

    Supplemental source - vdb-entry, x_refsource_REDHAT

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.