Executive Summary
The Apache Software Foundation has disclosed CVE-2026-92550, an unauthenticated denial-of-service (DoS) vulnerability in Apache Qpid Broker-J, the Java-based implementation of the AMQP message broker used to route messages between producers and consumers in enterprise messaging deployments. The flaw affects all versions through 10.1.0 and was published to NVD on September 25, 2026, carrying a CVSS v3.1 score of 7.5 (High).
A closely related issue, CVE-2026-92560 (CWE-770, allocation of resources without limits or throttling), was disclosed alongside it with the same affected version range and fix.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-92550 |
| CWE | CWE-789 (Memory Allocation with Excessive Size Value) |
| CVSS Score | 7.5 (High) |
| Type | Unauthenticated Denial of Service |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Related CVE | CVE-2026-92560 (CWE-770, resource exhaustion) |
| Assigner | Apache Software Foundation |
What's Vulnerable
Apache Qpid Broker-J decodes incoming AMQP 0-8 / 0-9 / 0-9-1 frames before a client has authenticated. According to the Apache advisory, a pre-authentication attacker can craft a frame whose type-size or element-count fields cause the broker to attempt an excessive memory allocation while parsing it. Because this happens in the decoder path — ahead of any credential check — a single malformed connection is enough to trigger the condition, and repeated attempts can exhaust broker memory and take the service down for every connected producer and consumer.
Qpid Broker-J is commonly embedded in enterprise integration platforms, financial messaging pipelines, and IoT telemetry backends wherever AMQP is used as the transport layer, making broker availability a shared dependency across everything wired into it.
Affected Versions
| Component | Affected Versions | Fixed Version |
|---|---|---|
| Apache Qpid Broker-J | ≤ 10.1.0 | 10.1.1 |
Apache recommends all users upgrade to 10.1.1, which fixes both CVE-2026-92550 and the related CVE-2026-92560.
Why This Matters
- No authentication required — the crash path is reachable before AMQP's own auth handshake completes, so exposure isn't mitigated by SASL or TLS client-cert policies alone.
- Availability, not confidentiality — this is a pure DoS; there is no indication of data exposure or remote code execution risk, but a broker outage can still cascade into every downstream service depending on message delivery.
- Low complexity, easy to automate — a single crafted frame is enough to reproduce the condition, meaning exploitation doesn't require sustained bandwidth or a distributed attack.
Recommended Actions
- Identify exposed brokers — inventory every Qpid Broker-J instance reachable from untrusted networks, including those embedded inside third-party integration platforms.
- Upgrade to 10.1.1 as soon as it's validated in a staging environment; this is the only complete fix for both CVE-2026-92550 and CVE-2026-92560.
- Restrict network exposure in the interim — place Qpid Broker-J behind a firewall or VPN so only trusted producers/consumers can open connections, since the flaw is pre-authentication.
- Monitor broker memory and connection logs for repeated malformed-frame connection attempts or unexplained memory spikes.
- Subscribe to the Apache Qpid security announcements list for follow-up advisories on this component.