CVE-2026-57822: apache software foundation apache activemq artemis Deserialization of Untrusted Data
Vulnerability summary
CVE-2026-57822 is a medium (CVSS 6.5) Deserialization of Untrusted Data vulnerability in apache software foundation apache activemq artemis. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.4% of scored vulnerabilities.
Timeline
- 10-09-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigger Java deserialization of certain method parameters that the broker will not utilise. The permitted types allow to craft a payload causing excessive computation and pinning the processing thread, leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.3.0 through 2.44.0. Users are recommended to upgrade to version 2.57.0, which fixes the issue.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.21 pp
From 0.49% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache software foundation2 products
- apache activemq artemis≥ 1.3.0, ≤ 2.44.0
- apache artemis≥ 2.50.0, ≤ 2.56.0
Apache1 product
- artemis≥ 1.3.0, < 2.44.0 | ≥ 2.50.0, < 2.57.0
2 vendors · 3 products