CVE-2026-101292: Red Hat Amq Broker 7

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

Affected products

• Red Hat Red Hat Amq Broker 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25: before 2.16.0.redhat-00057 (fixed in 2.16.0.redhat-00057)

Published 2026-09-28. Last modified 2026-09-29.