Executive brief
Red Hat Enterprise Application Platform (EAP) contains a messaging service called Artemis that allows untrusted data to be deserialized by default. An attacker with network access to the messaging service could send a malicious message that executes arbitrary code on the server, potentially compromising the entire application and any data it handles.
Technical details
Artemis's ObjectMessage.getObject() method uses ObjectInputStreamWithClassLoader for deserialization but leaves both allow-list and block-list empty by default. The isTrustedType() method returns true for all classes when the allow-list is empty, allowing unrestricted deserialization of arbitrary objects. This is a classic unsafe deserialization vulnerability reachable over the network by messaging clients.
Affected products
- Red Hat Enterprise Application Platform <UNKNOWN>
Timeline
- 2026-09-07: disclosed