Bug 2477945 (CVE-2026-49362)

Summary:	CVE-2026-49362 artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, dbruscin, dhanak, dlofthou, drichtar, drosa, ehelms, ehugonne, fmariani, ggainey, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jrokos, juwatts, jwon, kvanderr, mcarlett, mhulan, mnovotny, mosmerov, mposolda, msvehla, nmoumoul, nwallace, osousa, pberan, pbizzarr, pcreech, pdelbell, pesilva, pjindal, pmackay, rchan, rmartinc, rstancel, rstepani, sausingh, security-response-team, smaestri, smallamp, ssilvert, sthorger, tcunning, thjenkin, tmalecek, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-15 17:48:02 UTC

submitted through leadership channels

Missing Authentication — Artemis CORE CREATE_QUEUE(34) on ch1 creates durable queue pre-auth (JBoss EAP)

Missing authentication on the Artemis CORE protocol channel: an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker, enabling resource exhaustion and persistent broker-state manipulation without any credentials.

findings/jboss-eap_17.md

Comment 4 errata-xmlrpc 2026-09-10 16:35:11 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 5 errata-xmlrpc 2026-09-10 23:23:27 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545

Comment 6 Jon Orris 2026-09-15 14:41:14 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:67603 https://access.redhat.com/errata/RHSA-2026:67603

Comment 7 Jon Orris 2026-09-15 14:44:34 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

Via RHSA-2026:67604 https://access.redhat.com/errata/RHSA-2026:67604

Comment 8 Jon Orris 2026-09-22 12:56:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 9 Jon Orris 2026-09-22 12:58:37 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 10 Jon Orris 2026-09-22 13:00:42 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 11 Jon Orris 2026-09-22 15:35:44 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277