ActiveMQ Artemis (< 2.34.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/activemq-artemis--2.34.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 28 Sep 2026 14:15:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnsafe Reflection Vulnerability in Apache ActiveMQ Artemishttps://feed.craftedsignal.io/briefs/2026-09-activemq-artemis-reflection/Mon, 28 Sep 2026 14:15:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-activemq-artemis-reflection/Apache ActiveMQ Artemis versions prior to 2.34.0 are vulnerable to remote code execution or state manipulation via insecure reflection in the FederationStreamConnectMessage.getFederationPolicy() method.Apache ActiveMQ Artemis versions prior to 2.34.0 are susceptible to an unsafe reflection vulnerability residing within the FederationStreamConnectMessage.getFederationPolicy() method. The vulnerability arises because the class name (clazz) is read directly from the CORE protocol wire buffer without undergoing sufficient type validation before being passed to Class.forName(clazz).getConstructor().newInstance().

An authenticated attacker acting as a federation peer can transmit a specifically crafted FEDERATION_DOWNSTREAM_CONNECT packet to the broker. This packet forces the broker to instantiate arbitrary classes accessible within the Artemis module classloader. As a side effect of this instantiation, static initializers and no-argument constructors are executed. This behavior allows for malicious outcomes, including denial of service, memory exhaustion through excessive classloading, or unauthorized modification of the broker's internal state. This vulnerability poses a significant risk to the integrity and availability of message brokers configured for federation in enterprise environments.

Impact

Successful exploitation allows an authenticated peer to trigger arbitrary class instantiation within the broker's process. This can lead to system-wide denial of service, resource exhaustion, and potential compromise of the broker state. Given the role of ActiveMQ in enterprise messaging, this could disrupt critical business processes and data flow across internal and hybrid infrastructure.

Recommendation

  1. Upgrade Apache ActiveMQ Artemis to version 2.34.0 or later immediately to resolve the reflection flaw.
  2. Restrict federation configuration to trusted peers only and implement strict network access controls to limit access to the CORE protocol ports.
  3. Conduct an audit of existing federation setups to identify and remove unauthorized or unknown federation peers.
  4. Enable protocol-level logging to capture traffic patterns associated with FEDERATION_DOWNSTREAM_CONNECT packets for forensic analysis.
]]>highadvisoryvulnerabilitydeserializationmessage-broker