SB2026091029 - Multiple vulnerabilities in Apache Artemis

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091029

SB2026091029 - Multiple vulnerabilities in Apache Artemis

Published: September 10, 2026

Security Bulletin ID SB2026091029
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 29% Medium 43% Low 29%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-49362)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to manipulate broker state and cause a denial of service.

The vulnerability exists due to missing authentication in the CORE protocol handler when processing CORE protocol requests. A remote attacker can create arbitrary durable queues to manipulate broker state and cause a denial of service.


2) Missing Authentication for Critical Function (CVE-ID: CVE-2026-49363)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cluster node details.

The vulnerability exists due to missing authentication in the CORE protocol topology subscription feature when sending a SUBSCRIBE_TOPOLOGY request prior to authentication. A remote attacker can send a SUBSCRIBE_TOPOLOGY request to disclose cluster node details.


3) Insufficiently protected credentials (CVE-ID: CVE-2026-49364)

CWE-ID: CWE-522 - Insufficiently Protected Credentials

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose cluster administrative credentials.

The vulnerability exists due to insufficiently protected credentials in the initial cluster connection handshake when using discovery to connect to a cluster peer. A remote attacker can leverage discovery to capture cluster administrative credentials.


4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-57822)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to deserialization of untrusted data in message-based management parameter processing when processing message-based management requests. A remote privileged user can send a crafted management request containing parameters that cause excessive computation and pin a processing thread to cause a denial of service.

Exploitation requires MANAGE permission to perform management-via-messaging.


5) Missing Authentication for Critical Function (CVE-ID: CVE-2026-57967)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to hijack an existing authenticated session and assume its ongoing execution.

The vulnerability exists due to missing authentication in CORE protocol session reattachment when processing a crafted SESSION_REATTACH packet. A remote attacker can send a crafted CORE protocol SESSION_REATTACH packet to hijack an existing authenticated session and assume its ongoing execution.


6) Missing Authentication for Critical Function (CVE-ID: CVE-2026-67593)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to delete queues on an Artemis broker.

The vulnerability exists due to missing authentication and authorization checks in OpenWire protocol handling when processing a RemoveSubscriptionInfo command. A remote attacker can send a crafted OpenWire RemoveSubscriptionInfo command to delete queues on an Artemis broker.


7) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-75880)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in message selector wildcard handling when evaluating a consumer selector containing crafted wildcard usage during message delivery attempts. A remote user can attach a consumer with a crafted wildcard selector to cause a denial of service.


Remediation

Install update from vendor's website.

References