CVE-2026-57822
MEDIUM 6.5 ALL-YEARSWhen the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.7%chance of exploitation in 30 days · 52nd percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM · ADP
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Affected
Vendors Apache Software Foundation Apache
Products Apache Artemis Apache Activemq Artemis Artemis
Weakness (CWE)
- CWE-502: Deserialization of Untrusted Data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apache | Artemis | ≥ 1.3.0 and < 2.44.0 |
| Apache | Artemis | ≥ 2.50.0 and < 2.57.0 |
All CVSS metrics
- MEDIUM 6.5 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H