← Back to the live CVE advisory feed

CVE-2026-101292: Product identification pending

Severity

8.2 (HIGH)

Vendor

REDHAT

Affected versions

Before 2.34.0

Fixed version

2.34.0

Patch status

Patched

Published

2026-09-28T13:17:21.267

Modified

2026-09-28T14:17:14.497

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers () and no-argument constructors (()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

View the official NVD record for CVE-2026-101292

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.