CVE-2026-57822

Name of the Vulnerable Software and Affected Versions Apache Artemis versions 2.50.0 through 2.56.0 Apache ActiveMQ Artemis versions 1.3.0 through 2.44.0

Description When processing message-based management requests from an authenticated client with MANAGE permissions, the broker may trigger Java deserialization of specific method parameters that are not utilized. An attacker can craft a payload using permitted types to cause excessive computation and pin the processing thread, resulting in a denial of service.

Recommendations Upgrade Apache Artemis to version 2.57.0. Upgrade Apache ActiveMQ Artemis to version 2.57.0.