CVE-2026-92560

Apache Qpid Broker-J through version 10.1.0 contains a resource-allocation flaw (CWE-770) in its AMQP 0-10 protocol decoder, where attacker-controlled type size and count values from incoming frames cause the broker to allocate excessive memory. Because the flaw is reachable before authentication completes, any remote attacker who can reach an AMQP port can send crafted AMQP 0-10 frames to drive the broker into memory exhaustion, crashing or hanging the service — a denial of service only, with no indication of code execution or data exposure. All deployments running Broker-J through 10.1.0 that expose the AMQP 0-10 protocol on a network-reachable port are affected. The issue is fixed in version 10.1.1, and no CVSS score, public proof of concept, or known in-the-wild exploitation exists at this time.

What to do: Upgrade Apache Qpid Broker-J to 10.1.1, which fixes the flaw. If immediate upgrade is not possible, firewall AMQP ports (default TCP 5672) so only trusted clients can connect, and disable the AMQP 0-10 protocol on broker ports if it is not required (AMQP 1.0 and 0-8..0-9-1 are unaffected transports to fall back to). Monitor broker JVM memory usage and restart behavior for signs of memory-exhaustion attempts.