Apache ActiveMQ Artemis versions prior to 2.34.0 contain an unsafe reflection vulnerability in the FederationStreamConnectMessage.getFederationPolicy() method. This method calls Class.forName(clazz).getConstructor().newInstance() where the class name (clazz) is read directly from the CORE protocol wire buffer without validation. An authenticated federation peer can exploit this by sending a crafted FEDERATION_DOWNSTREAM_CONNECT packet with a malicious class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. The execution of static initializers and no-argument constructors before type casting can result in denial of service via system-property poisoning, out-of-memory conditions, or manipulation of broker state.

The vulnerability allows an authenticated federation peer to cause denial of service on the broker by triggering arbitrary class loading and instantiation. This can lead to system instability through system-property poisoning, excessive memory consumption, or manipulation of the broker's internal state. There is no indication of confidentiality impact, but integrity is affected due to possible broker state manipulation. The CVSS 3.1 score is 8.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

A security update is available that fixes this vulnerability in Apache ActiveMQ Artemis version 2.34.0 and later. Users of Red Hat AMQ Broker 7 should upgrade to version 2.34.0 or later to remediate this issue. Patch status is confirmed by the Red Hat advisory. No additional mitigations are indicated or required beyond applying the official fix.