CVE-2026-68073: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68073 Overview

CVE-2026-68073 is a denial-of-service vulnerability in Apache Qpid Broker-J affecting versions through 10.0.1. A pre-authentication attacker can leverage type nesting to trigger a StackOverflowError in the broker process. The flaw is categorized under [CWE-674] (Uncontrolled Recursion). No authentication is required to exploit this issue, which increases the exposure of internet-facing message brokers. The Apache Qpid project has released version 10.1.0 to remediate the vulnerability.

Critical Impact
Unauthenticated attackers can send crafted messages with deeply nested types to exhaust stack space and crash the Apache Qpid Broker-J process, disrupting messaging services.

Affected Products

Apache Qpid Broker-J versions through 10.0.1
Apache Qpid Broker-J deployments exposing AMQP endpoints to untrusted networks
Systems that have not upgraded to Apache Qpid Broker-J 10.1.0

Discovery Timeline

2026-08-05 - CVE-2026-68073 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68073

Vulnerability Analysis

Apache Qpid Broker-J is a Java implementation of the Advanced Message Queuing Protocol (AMQP). The broker parses type-encoded values from client-supplied frames during connection setup and message processing. When these encoded types contain excessive nesting, the parser recurses without bounding the depth. This recursion consumes the Java Virtual Machine (JVM) thread stack until a StackOverflowError terminates the handling thread. Because the vulnerable code path executes before authentication completes, any network-reachable attacker can trigger the condition.

The EPSS score for this issue is 0.193%, placing it in the 9.21 percentile for exploitation likelihood. The impact is limited to availability, but a repeated attack can keep the broker in a failed state and interrupt messaging pipelines that depend on it.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the type-decoding logic. The parser does not enforce a maximum nesting depth for composite or nested type structures. When the recursion depth exceeds the JVM stack size, the runtime raises a StackOverflowError that propagates out of the handler.

Attack Vector

An unauthenticated attacker establishes a network connection to the broker's AMQP listener. The attacker then transmits a payload containing deeply nested type definitions. The broker attempts to decode the payload recursively and the thread stack is exhausted. Refer to the Apache Mailing List Post and the Openwall OSS-Security Update for additional technical detail.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by crafted AMQP frames containing
// deeply nested type structures processed before authentication.

Detection Methods for CVE-2026-68073

Indicators of Compromise

Repeated java.lang.StackOverflowError entries in Qpid Broker-J logs originating from AMQP frame decoders
Unexpected broker thread termination or listener restarts correlated with inbound AMQP connections
Connection attempts from untrusted sources sending abnormally large or malformed AMQP type frames

Detection Strategies

Monitor Qpid Broker-J application logs for StackOverflowError stack traces referencing type decoding classes
Alert on abnormal spikes in AMQP connections that terminate abruptly during protocol negotiation
Inspect network telemetry for AMQP payloads exceeding expected size or structural complexity

Monitoring Recommendations

Enable verbose broker logging for connection lifecycle events and forward logs to a centralized SIEM
Track broker process uptime and thread pool health metrics to detect crash-restart patterns
Correlate source IP addresses of failed AMQP sessions to identify probing or repeated denial-of-service attempts

How to Mitigate CVE-2026-68073

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0, which contains the official fix
Restrict network access to the AMQP listener to trusted clients using firewall rules or network segmentation
Review broker logs for prior StackOverflowError occurrences that may indicate exploitation attempts

Patch Information

The Apache Qpid project fixed this issue in Apache Qpid Broker-J 10.1.0. Users running any version through 10.0.1 should upgrade. See the Apache Mailing List Post for release details.

Workarounds

Place the broker behind a reverse proxy or firewall that limits AMQP client sources to authenticated peers
Apply rate limiting on inbound connections to reduce the impact of repeated crash attempts
Enforce mutual TLS on AMQP listeners where feasible to reject unauthenticated clients earlier

bash

# Example: restrict AMQP port 5672 to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 5672 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5672 -j DROP