Unauthenticated Memory-Exhaustion DoS in Apache Qpid Broker-J AMQP 0-8/0-9/0-9-1 Decoder
Apache Qpid Broker-J through version 10.1.0 contains a denial-of-service vulnerability (CWE-789) in its AMQP 0-8/0-9/0-9-1 protocol decoder. A remote attacker who can reach the broker's AMQP port can send crafted frames whose type size/count fields request an excessively large memory allocation, and this happens before authentication, so no credentials are required. The resulting allocation can exhaust broker memory and crash or hang the service, disrupting message delivery for dependent applications. The issue affects all deployments running Qpid Broker-J version 10.1.0 or earlier, and it is fixed in version 10.1.1. No CVSS score has been assigned yet, and no public proof-of-concept or observed exploitation is known.
What to do: Upgrade Apache Qpid Broker-J to version 10.1.1, which fixes the flaw. If immediate upgrade is not possible, restrict network access to the broker's AMQP ports (typically 5672) using firewalls or allowlists so only trusted clients can connect, and consider disabling AMQP 0-8/0-9/0-9-1 support if only AMQP 1.0 is needed. Monitor broker memory usage and logs for unauthenticated connection attempts from unexpected sources.
| Product | Affected |
|---|---|
| Apache Qpid Broker-J | through 10.1.0 (all versions up to and including 10.1.0) |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Apache Qpid Broker-J through 10.1.0 has a pre-authentication AMQP 0-8/0-9 decoder DoS, CVE-2026-92550, fixed in 10.1.1.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views