CVE-2026-68075 Overview
CVE-2026-68075 affects Apache Qpid Broker-J through version 10.0.1. An authenticated attacker can exceed the session flow control incoming window, causing a denial of service condition on the broker. The vulnerability is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling), indicating the broker fails to enforce boundaries on client-supplied message flow. Apache has released version 10.1.0 to remediate the issue.
Critical Impact
Authenticated clients can disrupt AMQP messaging services by violating flow control limits, degrading availability for all broker consumers.
Affected Products
- Apache Qpid Broker-J versions through 10.0.1
- AMQP messaging deployments relying on Qpid Broker-J session flow control
- Downstream applications depending on Qpid Broker-J for message routing
Discovery Timeline
- 2026-08-05 - CVE-2026-68075 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-68075
Vulnerability Analysis
Apache Qpid Broker-J is a Java-based message broker implementing the Advanced Message Queuing Protocol (AMQP). Sessions in AMQP use flow control windows to regulate the number of unsettled messages a peer can send. The broker advertises an incoming window that clients must respect when transmitting frames.
In versions through 10.0.1, the broker does not adequately enforce this incoming window. An authenticated client can transmit frames beyond the advertised limit, causing the broker to consume resources without throttling. This condition maps to [CWE-770] and leads to denial of service against the broker process.
The issue requires valid credentials to open an AMQP session. Once authenticated, exploitation reduces to protocol-level misbehavior rather than requiring memory corruption or authentication bypass.
Root Cause
The root cause is missing validation of the session flow control state. The broker accepts additional frames from an authenticated peer even when the incoming window has been exhausted. Without a hard enforcement path that closes the offending session or rejects excess frames, the broker allocates resources beyond configured protocol limits.
Attack Vector
An attacker with valid broker credentials opens an AMQP connection and establishes a session. The attacker then sends message transfer frames at a rate or volume that exceeds the negotiated incoming window. The broker continues to process frames instead of applying back-pressure, leading to resource exhaustion and denial of service for legitimate clients. See the Apache Mailing List Thread and the Openwall OSS Security Update for the upstream disclosure.
Detection Methods for CVE-2026-68075
Indicators of Compromise
- Broker log entries reporting unusually high volumes of session transfer frames from a single authenticated principal.
- Sudden degradation in message throughput or unresponsive consumer sessions on Qpid Broker-J instances running versions through 10.0.1.
- JVM heap growth or thread pool saturation on the broker host without a corresponding rise in legitimate producer traffic.
Detection Strategies
- Monitor AMQP session-level metrics for peers whose frame counts exceed the advertised incoming window.
- Correlate authentication events with subsequent session flow anomalies to identify abusive client credentials.
- Enable verbose broker logging around session state transitions and flow control frames during triage.
Monitoring Recommendations
- Track broker process memory, thread count, and garbage collection pressure over rolling windows.
- Alert on sustained deviations in producer-to-consumer message ratios per authenticated user.
- Aggregate broker logs into a centralized analytics platform to detect flow control violations across clustered brokers.
How to Mitigate CVE-2026-68075
Immediate Actions Required
- Upgrade Apache Qpid Broker-J to version 10.1.0, which contains the fix for CVE-2026-68075.
- Audit broker user accounts and rotate credentials for any principals that do not require message publishing rights.
- Restrict network access to the broker so that only trusted application hosts can reach the AMQP listener.
Patch Information
Apache has released Apache Qpid Broker-J version 10.1.0 to remediate this vulnerability. Administrators running any release through 10.0.1 should upgrade. Refer to the Apache Mailing List Thread for release notes and the Openwall OSS Security Update for the coordinated disclosure.
Workarounds
- Reduce broker exposure by placing Qpid Broker-J behind network segmentation and firewall rules that limit AMQP client sources.
- Apply least-privilege authorization so authenticated users cannot open sessions on queues they do not need.
- Set conservative broker-side connection and session limits until the upgrade to 10.1.0 is completed.
# Verify installed Apache Qpid Broker-J version and plan upgrade
./qpid-server --version
# Expected post-patch output should report version 10.1.0 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
