CVE-2026-68074: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68074 Overview

CVE-2026-68074 is a pre-authentication denial-of-service vulnerability in Apache Qpid Broker-J. The flaw stems from unbounded symbol value caching, which allows a remote unauthenticated attacker to exhaust broker resources by sending crafted protocol traffic. Successful exploitation renders the messaging broker unavailable to legitimate clients.

The issue affects Apache Qpid Broker-J versions through 10.0.1. The Apache Qpid project recommends upgrading to version 10.1.0, which addresses the caching behavior. The vulnerability is tracked as CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A network-based attacker without credentials can trigger memory exhaustion, causing the Qpid broker to stop processing messages and disrupt any application depending on AMQP messaging.

Affected Products

Apache Qpid Broker-J versions through 10.0.1
AMQP messaging deployments relying on affected Qpid Broker-J releases
Downstream applications and services connected to a vulnerable broker

Discovery Timeline

2026-08-05 - CVE-2026-68074 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-68074

Vulnerability Analysis

Apache Qpid Broker-J caches symbol values received from AMQP peers to accelerate protocol parsing. The broker does not enforce an upper bound on the number of unique symbols retained in the cache. An attacker sending a stream of distinct symbols forces the broker to allocate memory for each entry indefinitely.

Because the caching path executes before client authentication completes, the vulnerability is reachable pre-authentication. Continued traffic drives the Java Virtual Machine toward heap exhaustion, at which point message processing halts and connected clients are dropped. The vulnerability is categorized as a resource exhaustion issue that leads to denial of service.

Root Cause

The root cause is missing throttling on the symbol interning mechanism used during AMQP frame decoding. Symbols supplied by a remote peer are stored without a maximum cache size, eviction policy, or per-connection quota. This design assumes cooperative clients and breaks down under adversarial input.

Attack Vector

Exploitation requires only network access to the broker's AMQP listener. An attacker opens one or more TCP connections and transmits AMQP frames containing large numbers of unique symbol values. No credentials, user interaction, or prior foothold are required. Additional technical detail is available in the Apache Thread Discussion and the Openwall OSS Security Update.

No verified proof-of-concept code is publicly available at this time. The vulnerability mechanism is described in prose based on the vendor advisory.

Detection Methods for CVE-2026-68074

Indicators of Compromise

Sustained memory growth in the Qpid Broker-J Java process without a corresponding increase in legitimate queue depth or client count
Repeated OutOfMemoryError entries or garbage collection pressure warnings in broker logs
Connections from unknown source addresses that transmit high volumes of AMQP frames before authenticating
Client disconnects and connection refusals correlated with broker heap saturation

Detection Strategies

Baseline broker heap usage and alert on deviations that exceed normal operating envelopes
Inspect AMQP traffic for anomalous volumes of unique symbol values originating from a single peer
Correlate broker process metrics with network flow data to identify pre-authentication traffic spikes

Monitoring Recommendations

Enable JVM heap and garbage collection telemetry export to a centralized observability platform
Track connection counts, authentication success rates, and frame throughput per source IP
Alert on any Qpid broker running version 10.0.1 or earlier detected in the environment

How to Mitigate CVE-2026-68074

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0 or later on all affected hosts
Inventory messaging infrastructure to confirm no legacy Qpid Broker-J instances remain in production
Restrict network reachability of the AMQP listener to trusted client subnets while patching is scheduled

Patch Information

The Apache Qpid project resolved the unbounded symbol caching behavior in version 10.1.0. Administrators should follow the upgrade guidance published on the Apache Thread Discussion and validate broker functionality in a staging environment before rolling out to production.

Workarounds

Place the broker behind a network access control list that permits only known client addresses
Terminate AMQP connections at a reverse proxy or firewall capable of rate-limiting new connections per source
Increase JVM heap monitoring frequency and configure automated restarts to shorten outage windows until patching completes

bash

# Example: restrict AMQP listener to trusted sources using iptables
iptables -A INPUT -p tcp --dport 5672 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5672 -j DROP