Individual Patch for EAP 7.4 Update 25 to Fix CVEs Artemis: CVE-2026-49362 / CVE-2026-57967, jackson databind: CVE-2026-54515 / CVE-2026-59889 (ELS)

Updated

An Individual Patch to fix the follow CVEs was release and is available This content is not included.here. The CVEs will also be included in the next Update, which will be EAP 7.4 Update 26. An Red Hat Enterprise Application Platform (EAP) Extended Life Subscription (ELS) is required to download this patch.

  • CVE-2026-49362 artemis-server: artemis core protocol permits unauthed queue creation
    Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state manipulation.

  • CVE-2026-57967 - artemis-server: Apache Artemis — session hijack via missing authentication
    in Apache Artemis, the REATTACH_SESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection() unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management authority (message injection, topology manipulation, journal access)

  • CVE-2026-49364 - jgroups: artemis cluster password leak via jgroups spoof
    Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations.

  • This content is not included.CVE-2026-54515 - jackson-databind: Ignored properties can be unexpectedly modified
    A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.

  • CVE-2026-59889 - Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
    A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped() method, responsible for handling @JsonUnwrapped properties, replays buffered JSON without properly checking the active view. This allows an attacker to write data to a property annotated with both @JsonView and @JsonUnwrapped even when deserializing under a less-privileged view. This can lead to mass-assignment and privilege escalation, enabling an untrusted caller to modify sensitive data that should be restricted to privileged users.

  • IllegalStateException: AMQ219071: The server discovery is disabled by default

SBR
Product(s)
Category
Components
Article Type