CVE-2026-92573

Apache Qpid Broker-J through 10.1.0 processes GZIP-compressed data without any limit on decompressed output size in the shared decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated user with the ability to publish messages can submit a small, highly compressed payload (a 'decompression bomb') that expands enormously in memory, exhausting the broker's heap and disrupting availability. The impact is denial of service against the broker itself, not data disclosure or code execution, but the same flaw is reachable through multiple paths including the HTTP management interface's JSON rendering. All users running Broker-J 10.1.0 or earlier are affected; version 10.1.1 fixes the issue. No public proof of concept or observed exploitation is known, and the issue is not in the CISA KEV catalog.

What to do: Upgrade Apache Qpid Broker-J to version 10.1.1, which enforces a decompressed-output limit. Until patched, restrict which authenticated clients may publish to the broker, disable or tightly limit access to the HTTP management API, and monitor broker memory and message sizes for unusually small compressed messages causing large allocations. Since exploitation requires valid producer credentials, review authentication logs for accounts publishing anomalous compressed payloads.