Aller au contenu
en Se connecter
8.2 Élevée

CVE-2026-101292 Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in…

Description

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat AMQ Broker 7 Versions non publiées
Red Hat JBoss Enterprise Application Platform 7 Versions non publiées
Red Hat JBoss Enterprise Application Platform 7.4.25 Versions non publiées
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat AMQ Broker 7

Les 88 CVE de Red Hat AMQ Broker 7 →
CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 Élevée CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 Élevée CVE-2026-93562 A flaw was found in Netty's HTTP/1 decoder 6.5 Moyenne CVE-2026-93574 A flaw was found in Netty's `netty-codec-http` component 6.5 Moyenne
Suivre cette CVE