see https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.6q218rre4ubh#bookmark=id.a4srunl7g7zw for detailed analysis

the unsafe Class.forName() reflection in FederationStreamConnectMessage.getFederationPolicy() is a separate code defect that requires its own fix. the reflection type-check fix landed independently in Artemis 2.34.0 via ARTEMIS-4766. When there is code that still needs to be fixed independently of an existing CVE, a separate CVE is warranted to ensure proper tracking, backporting, and remediation.

Fix status: The upstream fix is delivered in two stages. The primary fix — type validation before instantiation — was released in Artemis 2.34.0 via ARTEMIS-4766. This type check narrows the attack surface to only FederationPolicy implementations (2-3 classes with benign constructors), making exploitation impractical. A complete fix — full removal of the Class.forName() reflection — has been merged to main via ARTEMIS-6067 (2026-05-19) but is not yet released (expected in Artemis 2.55.0). The new CVE fix version should reference Artemis 2.34.0 (ARTEMIS-4766) as the primary fix.

Scored independently (post-auth context, PR:H), the standalone CVSS is 5.5 Medium. However, on products where CVE-2026-27446 is unpatched (e.g., JBoss EAP 7.4 ELS1 — "Will not fix"), this reflection is reachable pre-auth and the combined effective severity is higher.