Bug 2495823 (CVE-2026-57822) - CVE-2026-57822 artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address
Summary: CVE-2026-57822 artemis-core-client: activemq-artemis: Unsafe deserialization ...
Keywords:
Status: NEW
Alias: CVE-2026-57822
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-01 04:01 UTC by OSIDB Bzimport
Modified: 2026-09-10 05:49 UTC (History)
42 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-01 04:01:30 UTC 
Upstream report: CVE-2026-57822 reserved by Apache Security.
Reporter: Clebert Suconic (Apache Artemis committer) via PSIRTSUPT-18814.

Vulnerable class: org.apache.activemq.artemis.api.core.JsonUtil.fromJsonArray()
Vulnerable JAR: artemis-core-client
Affected versions: Artemis 2.16.0 through main (unfixed)

Attack requires MANAGE role (high-privilege administrative permission).
Impact: DoS only (deserialization bomb). No RCE or data exfiltration.
Allowlist (java.util,java.lang,javax.management) blocks URLDNS and all known
RCE gadget chains.

Fix: Upstream plans to disallow JsonUtil from performing server-side deserialization.
JsonUtil was only intended for client-side management console browsing.

Cross-reference: This is the same issue as IBM EAP report Medium Finding jboss-eap_38.md.
Note You need to log in before you can comment on or make changes to this bug.