CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering
Authenticated producers can exhaust memory on Qpid Broker-J via unbounded GZIP decompression.
Apache Qpid Broker-J through 10.1.0 does not bound output from the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 delivery, message conversion, and HTTP management JSON rendering. An authenticated producer can force unbounded decompression, exhaust memory, and disrupt broker availability. The vendor rates the issue important.
- Shared GZIP decompressor lacks a decompressed-output limit.
- Authenticated producers can exhaust memory via compressed AMQP data.
- Also affects message conversion and HTTP management JSON rendering through 10.1.0.
Vulnerabilities mentionedAll →
- CVE-2026-925736.5—GZIP Decompression Memory-Exhaustion DoS in Apache Qpid Broker-Jpublished · Apache Qpid Broker-J
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-92573 | GZIP Decompression Memory-Exhaustion DoS in Apache Qpid Broker-J Apache Qpid Broker-J through 10.1.0 processes GZIP-compressed data without any limit on decompressed output size in the shared decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated user with the ability to publish messages can submit a small, highly compressed payload (a 'decompression bomb') that expands enormously in memory, exhausting the broker's heap and disrupting availability. The impact is denial of service against the broker itself, not data disclosure or code execution, but the same flaw is reachable through multiple paths including the HTTP management interface's JSON rendering. All users running Broker-J 10.1.0 or earlier are affected; version 10.1.1 fixes the issue. No public proof of concept or observed exploitation is known, and the issue is not in the CISA KEV catalog. |
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org.apache.qpid:qpid-broker-core) through 10.1.0 Description: Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output...
This source does not provide full text. Read it at seclists.org.