Executive brief
Apache Artemis is a message broker that handles critical business communications and data routing. An unauthenticated attacker can remotely create arbitrary durable queues through the CORE protocol, allowing them to manipulate broker state and cause denial of service without requiring any credentials or authentication.
Technical details
This vulnerability is an authentication bypass in the CORE protocol handler of Apache Artemis. An unauthenticated remote attacker can invoke queue creation operations that should require authentication, allowing arbitrary durable queue creation and broker state manipulation. The attack is remotely exploitable over the network with no authentication required. Successful exploitation enables denial of service through resource exhaustion or broker misconfiguration. The issue affects Artemis versions 2.50.0–2.56.0 and ActiveMQ Artemis 1.0.0–2.44.0; a fix is available in version 2.57.0.
Affected products
- Apache Artemis 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis 1.0.0 through 2.44.0
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fix available in version 2.57.0