Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-86404

Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • eap7-activemq-artemis

    Version range not reported

  • eap7-glassfish-jsf

    Version range not reported

  • eap7-ironjacamar

    Version range not reported

  • eap7-jackson-annotations

    Version range not reported

  • eap7-jackson-core

    Version range not reported

  • eap7-jackson-databind

    Version range not reported

  • eap7-jackson-jaxrs-providers

    Version range not reported

  • eap7-jackson-modules-base

    Version range not reported

  • eap7-jackson-modules-java8

    Version range not reported

  • eap7-jboss-remoting

    Version range not reported

  • eap7-jboss-server-migration

    Version range not reported

  • eap7-netty

    Version range not reported

  • eap7-netty-transport-native-epoll

    Version range not reported

  • eap7-picketlink-bindings

    Version range not reported

  • eap7-picketlink-federation

    Version range not reported

  • eap7-undertow

    Version range not reported

  • eap7-wildfly

    Version range not reported

  • eap7-activemq-artemis

    Version range not reported

  • eap7-glassfish-jsf

    Version range not reported

  • eap7-ironjacamar

    Version range not reported

  • eap7-jackson-annotations

    Version range not reported

  • eap7-jackson-core

    Version range not reported

  • eap7-jackson-databind

    Version range not reported

  • eap7-jackson-jaxrs-providers

    Version range not reported

  • eap7-jackson-modules-base

    Version range not reported

  • eap7-jackson-modules-java8

    Version range not reported

  • eap7-jboss-remoting

    Version range not reported

  • eap7-jboss-server-migration

    Version range not reported

  • eap7-netty

    Version range not reported

  • eap7-netty-transport-native-epoll

    Version range not reported

  • eap7-picketlink-bindings

    Version range not reported

  • eap7-picketlink-federation

    Version range not reported

  • eap7-undertow

    Version range not reported

  • eap7-wildfly

    Version range not reported

  • org.apache.activemq/artemis-server

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • eap8-activemq-artemis

    Version range not reported

  • eap8-apache-cxf

    Version range not reported

  • eap8-artemis-wildfly-integration

    Version range not reported

  • eap8-bouncycastle

    Version range not reported

  • eap8-cryptacular

    Version range not reported

  • eap8-eap-product-conf-parent

    Version range not reported

  • eap8-hibernate

    Version range not reported

  • eap8-httpcomponents-asyncclient

    Version range not reported

  • eap8-ironjacamar

    Version range not reported

  • eap8-jackson-annotations

    Version range not reported

  • eap8-jackson-core

    Version range not reported

  • eap8-jackson-databind

    Version range not reported

  • eap8-jackson-dataformats-text

    Version range not reported

  • eap8-jackson-jaxrs-providers

    Version range not reported

  • eap8-jackson-modules-base

    Version range not reported

  • eap8-jackson-modules-java8

    Version range not reported

  • eap8-jakarta-xml-bind-api

    Version range not reported

  • eap8-jaxb

    Version range not reported

  • eap8-jaxbintros

    Version range not reported

  • eap8-jboss-logging

    Version range not reported

  • eap8-jboss-remoting

    Version range not reported

  • eap8-jbossws-api

    Version range not reported

  • eap8-jbossws-common-tools

    Version range not reported

  • eap8-jbossws-cxf

    Version range not reported

  • eap8-jbossws-jaxws-undertow-httpspi

    Version range not reported

  • eap8-jbossws-spi

    Version range not reported

  • eap8-jsf-impl

    Version range not reported

  • eap8-log4j

    Version range not reported

  • eap8-neethi

    Version range not reported

  • eap8-netty

    Version range not reported

  • eap8-netty-transport-native-epoll

    Version range not reported

  • eap8-nimbus-jose-jwt

    Version range not reported

  • eap8-parsson

    Version range not reported

  • eap8-saaj-impl

    Version range not reported

  • eap8-slf4j

    Version range not reported

  • eap8-undertow

    Version range not reported

  • eap8-wildfly

    Version range not reported

  • eap8-wildfly-elytron

    Version range not reported

  • eap8-wildfly-javadocs

    Version range not reported

  • eap8-ws-commons-XmlSchema

    Version range not reported

  • eap8-xml-security

    Version range not reported

  • artemis-server

    Version range not reported

  • artemis-core-client

    Version range not reported

  • artemis-jms-client

    Version range not reported

  • artemis-server

    Version range not reported

  • undertow-core

    Version range not reported

  • artemis-core-client

    Version range not reported

  • artemis-jms-client

    Version range not reported

  • artemis-server

    Version range not reported

  • undertow-core

    Version range not reported

  • wildfly-messaging-activemq-subsystem

    Version range not reported

  • artemis-core-client

    Version range not reported

  • artemis-jms-client

    Version range not reported

  • undertow-core

    Version range not reported

  • wildfly-messaging-activemq-subsystem

    Version range not reported

References 8

access.redhat.com

bugzilla.redhat.com