CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder
Apache Qpid Broker-J through 10.1.0 has a pre-authentication AMQP 0-8/0-9 decoder DoS, CVE-2026-92550, fixed in 10.1.1.
Apache disclosed CVE-2026-92550 in Qpid Broker-J through 10.1.0, affecting qpid-broker-plugins-amqp-0-8-protocol. A pre-authentication attacker can misuse type size and count handling in the AMQP 0-8, 0-9, and 0-9-1 decoder to cause excessive allocation and potential denial of service. Users are advised to upgrade to 10.1.1. Khaled Suliman is credited, and exploitation is not reported.
- Affects the AMQP 0-8, 0-9, and 0-9-1 decoder through 10.1.0.
- Pre-authentication size and count handling can cause denial of service.
- Fixed in Broker-J 10.1.1; Khaled Suliman is credited.
- CVEs
- CVE-2026-92550
- Vendors
- Apache
- Products
- Apache Qpid Broker-J
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92550 | Unauthenticated Memory-Exhaustion DoS in Apache Qpid Broker-J AMQP 0-8/0-9/0-9-1 Decoder | 7.5 | — |
From the original article
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org. apache. qpid:qpid-broker-plugins-amqp-0-8-protocol) through 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.