CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder
Pre-authentication AMQP 0-10 decoding in Apache Qpid Broker-J through 10.1.0 can exhaust memory; 10.1.1 fixes CVE-2026-92560.
Apache disclosed CVE-2026-92560 in Qpid Broker-J through 10.1.0, in the qpid-broker-plugins-amqp-0-10-protocol component. A pre-authentication attacker can abuse type size and count handling in the AMQP 0-10 decoder to force excessive memory allocation and potentially deny service. Version 10.1.1 fixes the issue. The report is credited to n0mi1k, and no exploitation is described.
- Affects Apache Qpid Broker-J through version 10.1.0.
- Pre-authentication AMQP 0-10 type handling can trigger huge allocations.
- Upgrade to 10.1.1 is recommended; no exploitation is reported.
- CVEs
- CVE-2026-92560
- Vendors
- Apache
- Products
- Apache Qpid Broker-J
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92560 | Pre-Auth Memory-Exhaustion Denial of Service in Apache Qpid Broker-J AMQP 0-10 Decoder | 7.5 | — |
From the original article
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org. apache. qpid:qpid-broker-plugins-amqp-0-10-protocol) through 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.