CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing
Pre-auth type nesting in Qpid Broker-J through 10.1.0 can stack-overflow the broker.
52
CVE-2026-92564
Pre-Auth Stack Overflow DoS in Apache Qpid Broker-J AMQP Field-Table Parsing
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Qpid Broker-J through version 10.1.0 contains a denial-of-service flaw (CWE-674, uncontrolled recursion) in how it decodes AMQP 0-8/0-9/0-9-1 field tables. An unauthenticated attacker can send a crafted message containing arbitrarily deeply nested types, driving recursive parsing until the JVM throws a StackOverflowError, which can crash or hang the broker. Because the flaw is pre-authentication, any host able to reach the broker's AMQP port can trigger it; availability of the messaging service is the impact, with no evidence of code execution or data exposure. The issue is fixed in version 10.1.1. There is no public proof of concept and no known exploitation in the wild.
What to do: Upgrade Apache Qpid Broker-J to version 10.1.1, which fixes the issue. If immediate upgrade is not possible, restrict network access to AMQP ports (e.g., 5672) to trusted clients only and consider disabling legacy AMQP 0-8/0-9/0-9-1 protocol support if it is not required. Monitor broker logs for StackOverflowError entries or unexpected restarts as indicators of attempted exploitation.
| Product | Affected |
|---|---|
| Apache Qpid Broker-J | through 10.1.0 (all versions up to and including 10.1.0) |
Estimated exposure
nichehundreds to low thousands of deployments, with only a small subset internet-exposed — Qpid Broker-J is a niche open-source Java AMQP broker with modest adoption relative to RabbitMQ/ActiveMQ, and internet-wide scans typically show only a small number of exposed AMQP endpoints attributable to it, so most installs are…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.