CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

Apache Qpid Broker-J through version 10.1.0 contains a resource-allocation flaw (CWE-770) in its AMQP 0-10 protocol decoder, where attacker-controlled type size and count values from incoming frames cause the broker to allocate excessive memory. Because the flaw is reachable before authentication completes, any remote attacker who can reach an AMQP port can send crafted AMQP 0-10 frames to drive the broker into memory exhaustion, crashing or hanging the service — a denial of service only, with no indication of code execution or data exposure. All deployments running Broker-J through 10.1.0 that expose the AMQP 0-10 protocol on a network-reachable port are affected. The issue is fixed in version 10.1.1, and no CVSS score, public proof of concept, or known in-the-wild exploitation exists at this time.