Krsecurity

Improper handling of length parameter inconsistency allows WebSocket message smuggling when the per-message-deflate extension is used. Per-message-deflate is a compression mechanism used to reduce the amount of data transmitted over a WebSocket connection.

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker. This action can occur before the connection authentication and authorization stage or at any time thereafter.