CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering
Authenticated producers can exhaust memory on Qpid Broker-J via unbounded GZIP decompression.
Apache Qpid Broker-J through 10.1.0 does not bound output from the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 delivery, message conversion, and HTTP management JSON rendering. An authenticated producer can force unbounded decompression, exhaust memory, and disrupt broker availability. The vendor rates the issue important.
- Shared GZIP decompressor lacks a decompressed-output limit.
- Authenticated producers can exhaust memory via compressed AMQP data.
- Also affects message conversion and HTTP management JSON rendering through 10.1.0.
- CVEs
- CVE-2026-92573
- Vendors
- Apache
- Products
- Apache Qpid Broker-J
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92573 | GZIP Decompression Memory-Exhaustion DoS in Apache Qpid Broker-J | 6.5 | — |
From the original article
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org. apache. qpid:qpid-broker-core) through 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.