Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Six CVEs affect Apache Qpid Broker-J through 10.1.0

1 source · 6 articlesFirst reported Updated ()
What's new

The newest advisories add CVE-2026-92573, an important authenticated memory-exhaustion flaw via unbounded GZIP decompression, and CVE-2026-92609, an important HTTP management session-fixation issue; neither names a fixed version.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Six CVEs in Apache Qpid Broker-J through 10.1.0 cover pre-auth DoS, GZIP exhaustion, delivery disruption, and session fixation; 10.1.1 fixes three.

On 2026-09-24, six oss-security advisories described vulnerabilities in Apache Qpid Broker-J through 10.1.0. CVE-2026-92550, in qpid-broker-plugins-amqp-0-8-protocol and credited to Khaled Suliman, and CVE-2026-92560, in qpid-broker-plugins-amqp-0-10-protocol and credited to n0mi1k, let a pre-authentication attacker misuse type size and count handling in the AMQP 0-8/0-9/0-9-1 and AMQP 0-10 decoders to force excessive allocation; neither report describes exploitation, and both are fixed in 10.1.1. CVE-2026-92564, rated important, allows unbounded type nesting in AMQP 0-8/0-9/0-9-1 field tables before authentication and can raise a StackOverflowError; it is also fixed in 10.1.1. CVE-2026-92573, rated important, does not limit output from the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 delivery, message conversion, and HTTP management JSON rendering, so an authenticated producer can exhaust memory. CVE-2026-92608, rated moderate, incompletely handles property-encoding exceptions when converting AMQP 1.0 messages to AMQP 0-10, allowing an authenticated producer to disrupt delivery to AMQP 0-10 consumers. CVE-2026-92609, rated important, does not renew the HTTP session after successful management authentication, so a remote attacker who can fix a session identifier can reuse it; unlike the first three issues, the advisories for CVE-2026-92573, CVE-2026-92608, and CVE-2026-92609 do not name a fixed release, and the reports do not disagree.

Key facts
  • Six oss-security advisories dated 2026-09-24 cover Apache Qpid Broker-J through 10.1.0.
  • CVE-2026-92550 (qpid-broker-plugins-amqp-0-8-protocol, Khaled Suliman) and CVE-2026-92560 (qpid-broker-plugins-amqp-0-10-protocol, n0mi1k) are pre-authentication excessive-allocation flaws in the AMQP 0-8/0-9/0-9-1 and AMQP 0-10 decoders;…
  • CVE-2026-92564, vendor-rated important, lets a pre-authentication attacker nest types in AMQP 0-8/0-9/0-9-1 field tables and trigger a StackOverflowError; fixed in 10.1.1.
  • CVE-2026-92573, vendor-rated important, leaves the shared GZIP decompressor unbounded for AMQP 0-8/0-9/0-9-1 and 0-10 delivery, message conversion, and HTTP management JSON rendering, so authenticated producers can exhaust memory; no fixed…
  • CVE-2026-92608, vendor-rated moderate, mishandles some property-encoding exceptions when converting AMQP 1.0 messages to AMQP 0-10, letting authenticated producers disrupt delivery to AMQP 0-10 consumers; no fixed version is stated.
  • CVE-2026-92609, vendor-rated important, does not renew the HTTP session after successful management authentication, so a remote attacker who fixes a session identifier can reuse it; an upgrade is recommended but no version is named.
  • The six reports are complementary and do not contradict one another.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-92564CVE-2026-92609CVE-2026-92573CVE-2026-92560CVE-2026-92550CVE-2026-92608
Vendors
Apache
Products
Apache Qpid Broker-J
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · Sep 24, 2026 oss-securityFirst report

    CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

    Apache Qpid Broker-J through 10.1.0 has a pre-authentication AMQP 0-8/0-9 decoder DoS, CVE-2026-92550, fixed in 10.1.1.

  2. · Sep 24, 2026 oss-security

    CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

    Pre-authentication AMQP 0-10 decoding in Apache Qpid Broker-J through 10.1.0 can exhaust memory; 10.1.1 fixes CVE-2026-92560.

  3. · Sep 24, 2026 oss-security

    CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

    Pre-auth type nesting in Qpid Broker-J through 10.1.0 can stack-overflow the broker.

  4. · Sep 24, 2026 oss-security

    CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

    Authenticated producers can exhaust memory on Qpid Broker-J via unbounded GZIP decompression.

  5. · Sep 24, 2026 oss-security

    CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

    Authenticated producers can disrupt AMQP 0-10 delivery on Qpid Broker-J through 10.1.0.

  6. · Sep 24, 2026 oss-security

    CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

    Apache Qpid Broker-J through 10.1.0 has a session-fixation flaw in HTTP management authentication.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-92609
+5 related CVEs
CVE-2026-92560CVE-2026-92564CVE-2026-92608CVE-2026-92550CVE-2026-92573
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a…
9.8
group max
—