CVE-2026-101292

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.34.0

Description An unsafe reflection issue exists in the FederationStreamConnectMessage.getFederationPolicy() function. The system calls Class.forName(clazz).getConstructor().newInstance() using a clazz value read directly from the CORE protocol wire buffer without proper type validation. An authenticated federation peer can send a FEDERATION DOWNSTREAM CONNECT packet containing a crafted class name, forcing the broker to load and instantiate arbitrary classes available to the Artemis module classloader. This process executes static initializers (<clinit>) and no-argument constructors (<init>()) as side effects, which can lead to denial of service through system-property poisoning, out-of-memory conditions during classloading, or manipulation of the broker state.

Recommendations Update to version 2.34.0 or later.