Executive brief
Apache Artemis is a message broker used for reliable messaging and event processing. An authenticated client with management permissions can exploit unsafe Java deserialization to cause excessive CPU consumption and hang the broker, disrupting message processing for all users.
Technical details
This vulnerability is a Java deserialization flaw in the message-based management request processing subsystem. When an authenticated and authorized client sends crafted management-via-messaging requests, the broker deserializes method parameters without proper validation, allowing attackers to instantiate objects designed to consume excessive CPU (ReDoS or infinite computation patterns). The attack requires the client to be already authenticated with MANAGE permission, meaning it affects internal infrastructure and trusted integrations. Exploitation causes the processing thread to hang indefinitely, leading to denial of service. The issue was fixed in version 2.57.0.
Affected products
- Apache Artemis 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis 1.3.0 through 2.44.0
Timeline
- 2026-09-10: disclosed: CVE-2026-57822 published
- 2026-09-10: patched: Version 2.57.0 released with fix