Red Hat AMQ Broker/JBoss Enterprise Application Platform up to 2.33.x FederationStreamConnectMessage clazz denial of service

Summaryinfo

A vulnerability described as problematic has been identified in Red Hat AMQ Broker and JBoss Enterprise Application Platform up to 2.33.x. This issue affects the function FederationStreamConnectMessage.getFederationPolicy of the component FederationStreamConnectMessage. Executing a manipulation of the argument clazz can lead to denial of service. This vulnerability is tracked as CVE-2026-101292. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Red Hat AMQ Broker and JBoss Enterprise Application Platform up to 2.33.x and classified as problematic. This vulnerability affects the function FederationStreamConnectMessage.getFederationPolicy of the component FederationStreamConnectMessage. The manipulation of the argument clazz with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect integrity, and availability. CVE summarizes:

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (<clinit>) and no-argument constructors (<init>()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.

The advisory is shared for download at access.redhat.com. This vulnerability was named CVE-2026-101292 since 09/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/28/2026). The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.34.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Red Hat

Name

• AMQ Broker
• JBoss Enterprise Application Platform

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion