CVE-2026-101292

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

EUVD-2026-88242

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

CVE-2026-101292

Apache ActiveMQ Artemis versions before 2.34.0 are vulnerable to an unsafe reflection vulnerability within the FederationStreamConnectMessage.getFederationPolicy() method. The root cause is the direct reading of a class name from the CORE protocol wire buffer without proper type validation, which...

artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...

artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...