CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing
Pre-auth type nesting in Qpid Broker-J through 10.1.0 can stack-overflow the broker.
Apache Qpid Broker-J through 10.1.0 allows unbounded type nesting while processing AMQP 0-8, 0-9, and 0-9-1 field tables before authentication. A remote attacker can trigger a StackOverflowError and potentially cause denial of service. Version 10.1.1 fixes the issue; the vendor rates it important.
- Pre-authentication attacker can nest types in AMQP 0-8/0-9/0-9-1 field tables.
- Deep nesting triggers StackOverflowError and can deny service.
- Fixed in Broker-J 10.1.1; versions through 10.1.0 are affected.
Vulnerabilities mentionedAll →
- Pre-Auth Stack Overflow DoS in Apache Qpid Broker-J AMQP Field-Table Parsingpublished · Apache Qpid Broker-J
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-92564 | Pre-Auth Stack Overflow DoS in Apache Qpid Broker-J AMQP Field-Table Parsing Apache Qpid Broker-J through version 10.1.0 contains a denial-of-service flaw (CWE-674, uncontrolled recursion) in how it decodes AMQP 0-8/0-9/0-9-1 field tables. An unauthenticated attacker can send a crafted message containing arbitrarily deeply nested types, driving recursive parsing until the JVM throws a StackOverflowError, which can crash or hang the broker. Because the flaw is pre-authentication, any host able to reach the broker's AMQP port can trigger it; availability of the messaging service is the impact, with no evidence of code execution or data exposure. The issue is fixed in version 10.1.1. There is no public proof of concept and no known exploitation in the wild. Do: Upgrade Apache Qpid Broker-J to version 10.1.1, which fixes the issue. If immediate upgrade is not possible, restrict network access to AMQP ports (e.g., 5672) to trusted clients only and consider disabling legacy AMQP 0-8/0-9/0-9-1 protocol support if it is not required. Monitor broker logs for StackOverflowError entries or unexpected restarts as indicators of attempted exploitation. |
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol) through 10.1.0 Description: A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue. Credit: n0mi1k (reporter)...
This source does not provide full text. Read it at seclists.org.