CVE-2026-68060: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68060 Overview

CVE-2026-68060 is a pre-authentication denial of service vulnerability in Apache Qpid Broker-J. An unauthenticated attacker can exploit improper handling of type size and count values to trigger excessive memory allocation. This resource exhaustion condition can render the broker unresponsive and disrupt message delivery for connected clients.

The issue affects Apache Qpid Broker-J through version 10.0.1. The Apache Qpid project has released version 10.1.0 to address the flaw. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated remote attackers can exhaust broker memory resources and cause denial of service against Apache Qpid Broker-J messaging infrastructure.

Affected Products

Apache Qpid Broker-J versions through 10.0.1
AMQP messaging deployments relying on Qpid Broker-J
Java-based messaging brokers using vulnerable Qpid releases

Discovery Timeline

2026-08-05 - CVE-2026-68060 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68060

Vulnerability Analysis

Apache Qpid Broker-J processes Advanced Message Queuing Protocol (AMQP) frames that include type descriptors, size fields, and count fields. The broker allocates buffers and object collections based on these attacker-supplied values before authentication completes. When the values are not adequately bounded, the broker attempts allocations that consume disproportionate memory relative to the network input received.

An attacker connecting to the broker's listening port can submit crafted protocol frames advertising very large sizes or counts. The broker honors these values during parsing, triggering excessive heap allocation. Repeated or parallel requests amplify the effect and drive the Java Virtual Machine (JVM) toward OutOfMemoryError conditions.

Because the flaw is reachable prior to authentication, any network-accessible broker instance is exposed. Exploitation does not require valid credentials, user interaction, or knowledge of internal broker state.

Root Cause

The root cause is missing enforcement of upper bounds on type size and count fields during AMQP frame decoding. The affected code paths allocate memory proportional to attacker-controlled values without validating those values against configured limits or available resources.

Attack Vector

The attack vector is network-based against the broker's AMQP listener. An unauthenticated remote client opens a connection and transmits malformed or oversized protocol frames. The broker parses the type descriptors and allocates memory according to declared sizes, exhausting the JVM heap and degrading or halting service.

Details of the flaw are described in the Apache Mailing List Thread and the Openwall OSS-Security Update. No public proof-of-concept exploit is currently available, and the EPSS probability is 0.193%.

Detection Methods for CVE-2026-68060

Indicators of Compromise

Sudden spikes in JVM heap usage on Qpid Broker-J processes without corresponding legitimate traffic volume.
OutOfMemoryError entries or GC overhead warnings in broker logs shortly after new client connections.
Connection attempts from unexpected source addresses to AMQP ports (default 5672 or 5671).
Unusually large declared frame sizes recorded in broker protocol trace logs.

Detection Strategies

Monitor broker process memory and garbage collection metrics for abnormal growth patterns.
Enable AMQP protocol tracing to capture oversized type size and count declarations from clients.
Correlate broker crashes or restarts with preceding connection activity from external sources.
Alert on repeated broker restarts by service supervisors such as systemd or container orchestrators.

Monitoring Recommendations

Ingest Qpid Broker-J logs and JVM telemetry into a centralized logging or SIEM platform for pattern analysis.
Track AMQP connection rates per source IP and flag anomalous bursts against baseline traffic.
Instrument broker hosts with resource watchdogs that report heap pressure and thread starvation.

How to Mitigate CVE-2026-68060

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0 or later on all broker hosts.
Restrict network access to broker AMQP ports using firewalls, security groups, or service meshes.
Require Transport Layer Security (TLS) and client authentication on all listeners where feasible.
Review broker logs for prior connection attempts consistent with resource exhaustion behavior.

Patch Information

The Apache Qpid project fixed this vulnerability in Apache Qpid Broker-J 10.1.0. Administrators running any version through 10.0.1 should plan an immediate upgrade. Refer to the Apache Mailing List Thread for release details and the Openwall OSS-Security Update for the coordinated disclosure notice.

Workarounds

Place the broker behind a network filter that limits inbound connections to trusted clients only.
Configure JVM heap and connection limits to reduce blast radius when upgrade cannot be applied immediately.
Deploy rate limiting at the load balancer or reverse proxy to throttle rapid connection attempts.
Isolate broker instances into dedicated network segments to contain resource exhaustion impact.

bash

# Configuration example: restrict access to AMQP listeners using iptables
iptables -A INPUT -p tcp --dport 5672 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5671 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5672 -j DROP
iptables -A INPUT -p tcp --dport 5671 -j DROP