Six CVEs affect Apache Qpid Broker-J through 10.1.0

Six CVEs in Apache Qpid Broker-J through 10.1.0 cover pre-auth DoS, GZIP exhaustion, delivery disruption, and session fixation; 10.1.1 fixes three.

On 2026-09-24, six oss-security advisories described vulnerabilities in Apache Qpid Broker-J through 10.1.0. CVE-2026-92550, in qpid-broker-plugins-amqp-0-8-protocol and credited to Khaled Suliman, and CVE-2026-92560, in qpid-broker-plugins-amqp-0-10-protocol and credited to n0mi1k, let a pre-authentication attacker misuse type size and count handling in the AMQP 0-8/0-9/0-9-1 and AMQP 0-10 decoders to force excessive allocation; neither report describes exploitation, and both are fixed in 10.1.1. CVE-2026-92564, rated important, allows unbounded type nesting in AMQP 0-8/0-9/0-9-1 field tables before authentication and can raise a StackOverflowError; it is also fixed in 10.1.1. CVE-2026-92573, rated important, does not limit output from the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 delivery, message conversion, and HTTP management JSON rendering, so an authenticated producer can exhaust memory. CVE-2026-92608, rated moderate, incompletely handles property-encoding exceptions when converting AMQP 1.0 messages to AMQP 0-10, allowing an authenticated producer to disrupt delivery to AMQP 0-10 consumers. CVE-2026-92609, rated important, does not renew the HTTP session after successful management authentication, so a remote attacker who can fix a session identifier can reuse it; unlike the first three issues, the advisories for CVE-2026-92573, CVE-2026-92608, and CVE-2026-92609 do not name a fixed release, and the reports do not disagree.

• Six oss-security advisories dated 2026-09-24 cover Apache Qpid Broker-J through 10.1.0.
• CVE-2026-92550 (qpid-broker-plugins-amqp-0-8-protocol, Khaled Suliman) and CVE-2026-92560 (qpid-broker-plugins-amqp-0-10-protocol, n0mi1k) are pre-authentication excessive-allocation flaws in the AMQP 0-8/0-9/0-9-1 and AMQP 0-10 decoders;…
• CVE-2026-92564, vendor-rated important, lets a pre-authentication attacker nest types in AMQP 0-8/0-9/0-9-1 field tables and trigger a StackOverflowError; fixed in 10.1.1.
• CVE-2026-92573, vendor-rated important, leaves the shared GZIP decompressor unbounded for AMQP 0-8/0-9/0-9-1 and 0-10 delivery, message conversion, and HTTP management JSON rendering, so authenticated producers can exhaust memory; no fixed…
• CVE-2026-92608, vendor-rated moderate, mishandles some property-encoding exceptions when converting AMQP 1.0 messages to AMQP 0-10, letting authenticated producers disrupt delivery to AMQP 0-10 consumers; no fixed version is stated.
• CVE-2026-92609, vendor-rated important, does not renew the HTTP session after successful management authentication, so a remote attacker who fixes a session identifier can reuse it; an upgrade is recommended but no version is named.