You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@artemis.apache.org by ro...@apache.org on 2026/09/09 20:42:50 UTC
(artemis-website) 04/09: update security page for CVE-2026-57822
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/artemis-website.git
commit 87e6025601553a3d39de2b22db7cf065940e3b53
Author: Robbie Gemmell <ro...@apache.org>
AuthorDate: Wed Sep 9 19:43:11 2026 +0100
update security page for CVE-2026-57822
---
src/components/artemis/security.md | 2 ++
.../CVE-2026-57822-announcement.txt | 22 ++++++++++++++++++++++
2 files changed, 24 insertions(+)
diff --git a/src/components/artemis/security.md b/src/components/artemis/security.md
index 199d9cc4..0da54d44 100644
--- a/src/components/artemis/security.md
+++ b/src/components/artemis/security.md
@@ -8,6 +8,8 @@ type: artemis
Details of security problems fixed in released versions of Apache Artemis are detailed below.
See the main [Security Advisories](../../security-advisories) page for details for other components and general information such as reporting new security issues.
+
+* [CVE-2026-57822](../../security-advisories.data/CVE-2026-57822-announcement.txt) - Message-based management parameter deserialization may lead to denial of service
* [CVE-2026-49364](../../security-advisories.data/CVE-2026-49364-announcement.txt) - Pre-Authentication Cluster Credential Exposure to Discovered Peers
* [CVE-2026-49363](../../security-advisories.data/CVE-2026-49363-announcement.txt) - Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription
* [CVE-2026-49362](../../security-advisories.data/CVE-2026-49362-announcement.txt) - Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation
diff --git a/src/security-advisories.data/CVE-2026-57822-announcement.txt b/src/security-advisories.data/CVE-2026-57822-announcement.txt
new file mode 100644
index 00000000..cff9b112
--- /dev/null
+++ b/src/security-advisories.data/CVE-2026-57822-announcement.txt
@@ -0,0 +1,22 @@
+Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service
+
+Severity: important
+
+Affected versions:
+- Apache Artemis (org.apache.artemis:artemis-core-client) 2.50.0 through 2.56.0
+- Apache ActiveMQ Artemis (org.apache.activemq:artemis-core-client) 1.3.0 through 2.44.0
+
+Description:
+When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service.
+
+This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0.
+
+Users are recommended to upgrade to version 2.57.0, which fixes the issue.
+
+Credit:
+Clebert Suconic (finder)
+Mike Read (reporter)
+
+References:
+https://artemis.apache.org
+https://www.cve.org/CVERecord?id=CVE-2026-57822
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@artemis.apache.org
For additional commands, e-mail: commits-help@artemis.apache.org