Quick answers
- Is CVE-2026-57822 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57822 being exploited in the wild.
- How severe is CVE-2026-57822?
- Medium severity, with a CVSS score of 6.5, published 10 September 2026.
- Which products and versions are affected?
- Apache Activemq Artemis 1.3.0 through 2.44.0; Apache Artemis 2.50.0 through 2.56.0.
- Is there a fix for CVE-2026-57822?
- A patch was published on 2026-09-10: Version 2.57.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57822 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-57822?
- Check whether you run Apache Activemq Artemis or Apache Artemis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a Java deserialization flaw in the message-based management request processing subsystem. When an authenticated and authorized client sends crafted management-via-messaging requests, the broker deserializes method parameters without proper validation, allowing attackers to instantiate objects designed to consume excessive CPU (ReDoS or infinite computation patterns). The attack requires the client to be already authenticated with MANAGE permission, meaning it affects internal infrastructure and trusted integrations. Exploitation causes the processing thread to hang indefinitely, leading to denial of service. The issue was fixed in version 2.57.0.
Affected products
- Apache Artemis 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis 1.3.0 through 2.44.0
Timeline
- 2026-09-10: disclosed: CVE-2026-57822 published
- 2026-09-10: patched: Version 2.57.0 released with fix