CVE-2026-57822 Overview
CVE-2026-57822 is a denial-of-service vulnerability in Apache ActiveMQ Artemis and Apache Artemis brokers. The flaw occurs when the broker processes message-based management requests sent by authenticated clients holding the MANAGE permission. Parameter processing triggers Java deserialization of method arguments the broker never uses. An authorized attacker can craft a payload using permitted types that causes excessive computation, pinning the processing thread and degrading broker availability.
Critical Impact
An authenticated messaging client with MANAGE permission can send a crafted management message that consumes broker CPU resources and blocks message processing threads, resulting in denial of service.
Affected Products
- Apache Artemis versions 2.50.0 through 2.56.0
- Apache ActiveMQ Artemis versions 1.3.0 through 2.44.0
- Fixed in Apache Artemis version 2.57.0
Discovery Timeline
- 2026-09-10 - CVE-2026-57822 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-57822
Vulnerability Analysis
Apache ActiveMQ Artemis supports management-via-messaging, allowing authorized clients to invoke broker management operations by sending specially formatted messages. When the broker parses these management requests, it deserializes Java objects passed as method parameters even when those parameters are not consumed by the target management method.
The deserialization uses a restricted allow-list of permitted types, which prevents classic remote code execution through gadget chains. However, the allow-list still includes types that can be nested or sized to produce disproportionate computational cost during deserialization. Attackers exploit this asymmetry between payload size and processing effort.
Root Cause
The root cause is unnecessary Java deserialization of method parameters that the broker discards without using [CWE-502]. Because deserialization occurs before parameter relevance is evaluated, the broker performs expensive object graph reconstruction for values that serve no functional purpose, wasting CPU cycles on hostile input.
Attack Vector
Exploitation requires an authenticated messaging client with MANAGE permission on the broker. The attacker constructs a management message whose parameter section contains a serialized Java object graph composed of permitted types arranged to maximize deserialization cost. When the broker processes the request, the handling thread stalls under the computational load, and repeated requests can exhaust broker processing capacity and deny service to legitimate clients.
Because the vulnerability lives in the parameter-parsing path rather than in a specific management operation, any management request accepting object parameters is a viable delivery channel. Refer to the Apache Security Mailing List Thread and the Openwall OSS Security Discussion for additional context.
Detection Methods for CVE-2026-57822
Indicators of Compromise
- Sustained high CPU utilization on broker JVM threads handling management addresses such as activemq.management.
- Unusual volume of message-based management requests originating from a single authenticated client identity.
- Broker thread dumps showing processing threads blocked inside Java deserialization frames (ObjectInputStream.readObject) during management request handling.
- Growing queue depth and client-side timeouts for producers and consumers while management traffic remains active.
Detection Strategies
- Enable Artemis audit logging for management operations and alert on repeated management requests from a single principal within a short window.
- Baseline normal management-via-messaging traffic and flag deviations in message rate, payload size, or sender identity.
- Correlate broker performance metrics (thread pool saturation, GC pressure) with management address activity to surface abuse patterns.
Monitoring Recommendations
- Instrument JMX metrics for Artemis thread pools and management queue consumption, exporting to a centralized SIEM.
- Monitor authentication events for clients that acquire the MANAGE role, especially newly created or infrequently used accounts.
- Track the size distribution of messages sent to activemq.management and alert on outliers indicative of crafted payloads.
How to Mitigate CVE-2026-57822
Immediate Actions Required
- Upgrade Apache Artemis and Apache ActiveMQ Artemis brokers to version 2.57.0, which removes the unnecessary deserialization behavior.
- Audit all messaging accounts holding the MANAGE permission and revoke it from principals that do not require management access.
- Rotate credentials for any account with MANAGE permission if broker logs show anomalous management traffic.
Patch Information
Apache has released Apache Artemis 2.57.0, which fixes CVE-2026-57822. Administrators should plan an upgrade from any affected version, including Apache ActiveMQ Artemis 1.3.0 through 2.44.0 and Apache Artemis 2.50.0 through 2.56.0. The upstream advisory is published on the Apache Security Mailing List Thread.
Workarounds
- Restrict the MANAGE role in broker.xml to a minimal set of trusted operator accounts until patching is complete.
- Isolate the management address (activemq.management) behind network controls that only permit connections from administrative hosts.
- Apply per-connection resource limits and CPU throttling on the broker host to contain the impact of a stalled processing thread.
# Example: restrict MANAGE permission to a single trusted role in broker.xml
# <security-setting match="activemq.management">
# <permission type="manage" roles="broker-admins"/>
# </security-setting>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
