Vulnerabilitymedium
CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing
AI summary · grok-4.7Summaries by Vani AI
Pre-auth type nesting in Qpid Broker-J through 10.1.0 can stack-overflow the broker.
Apache Qpid Broker-J through 10.1.0 allows unbounded type nesting while processing AMQP 0-8, 0-9, and 0-9-1 field tables before authentication. A remote attacker can trigger a StackOverflowError and potentially cause denial of service. Version 10.1.1 fixes the issue; the vendor rates it important.
Key facts
- Pre-authentication attacker can nest types in AMQP 0-8/0-9/0-9-1 field tables.
- Deep nesting triggers StackOverflowError and can deny service.
- Fixed in Broker-J 10.1.1; versions through 10.1.0 are affected.
- CVEs
- CVE-2026-92564
- Vendors
- Apache
- Products
- Apache Qpid Broker-J
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92564 | Pre-Auth Stack Overflow DoS in Apache Qpid Broker-J AMQP Field-Table Parsing | 7.5 | — |
From the original article
Posted by Daniil Kirilyuk on Sep 24 Severity: important Affected versions: - Apache Qpid Broker-J (org. apache. qpid:qpid-broker-plugins-amqp-0-8-protocol) through 10.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.