{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat JBoss Enterprise Application Platform 7.4.25: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-jboss-enterprise-application-platform-7-4-25/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-jboss-enterprise-application-platform-7-4-25/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101292/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101292/",
   "title": "CVE-2026-101292 · Red Hat JBoss Enterprise Application Platform 7.4.25 · disclosed",
   "content_text": "Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers (\u003cclinit\u003e) and no-argument constructors (\u003cinit\u003e()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation.",
   "date_published": "2026-09-28T12:44:28Z"
  }
 ]
}