GHSA-q97r-w4hq-94grHighCVSS 8.8
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage...
🔗 CVE IDs covered (1)
📋 Description
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-86404
- https://access.redhat.com/security/cve/CVE-2026-86404
- https://bugzilla.redhat.com/show_bug.cgi?id=2477930
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:53646
- https://github.com/advisories/GHSA-q97r-w4hq-94gr