CVE-2026-101292
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in…
- Risk score
- 61/100
- CVSS
- 8.2 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated feder…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.34.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.2 high
- Remotely exploitable without logging in
References
Original description
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.
Last activity 28 Sep 2026. Patch Forecast updates every hour.