CVE-2026-68077: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68077 is a denial of service flaw in Apache Qpid Broker-J where authenticated attackers exploit disposition frames with illegal ranges to cause excessive CPU usage. This article covers technical details, affected versions through 10.0.1, impact analysis, and mitigation strategies including upgrading to version 10.1.0.

CVE-2026-68077 Overview

CVE-2026-68077 is a denial of service vulnerability in Apache Qpid Broker-J affecting all versions through 10.0.1. An authenticated attacker can craft a disposition frame with large or illegal ranges. The broker's naive range handling causes excessive CPU consumption, leading to denial of service. The Apache Qpid project has released version 10.1.0 to address the issue. The weakness is classified under [CWE-606: Unchecked Input for Loop Condition].

Critical Impact
Authenticated attackers can exhaust broker CPU resources by sending malformed AMQP disposition frames, disrupting messaging service availability for all connected clients.

Affected Products

Apache Qpid Broker-J versions through 10.0.1
AMQP messaging deployments using vulnerable Qpid Broker-J releases
Java-based Qpid broker instances exposed to authenticated AMQP clients

Discovery Timeline

2026-08-05 - CVE-2026-68077 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68077

Vulnerability Analysis

Apache Qpid Broker-J implements the Advanced Message Queuing Protocol (AMQP). AMQP peers use disposition frames to communicate the state of message transfers across ranges of delivery identifiers. The broker processes these ranges without adequate validation of size or legality. When an attacker submits a disposition frame containing unusually large or malformed ranges, the broker iterates naively across the specified values. This consumes disproportionate CPU cycles and blocks legitimate message processing on the affected connection and broker threads.

Root Cause

The root cause is unchecked input used to drive loop iteration, aligning with [CWE-606]. The broker does not bound or sanity-check the range parameters supplied in disposition frames before entering iteration logic. As a result, an authenticated client controls the number of iterations the broker performs. Illegal ranges, including inverted or overlapping bounds, further amplify the processing cost. This design flaw converts a routine protocol operation into an algorithmic denial of service primitive.

Attack Vector

Exploitation requires an authenticated AMQP session against the broker. The attacker establishes a connection, opens a session, and transmits a crafted disposition frame with abusive range values. The broker's dispatcher enters CPU-intensive processing that starves other operations. Repeated frames from a single authenticated client can degrade service for all tenants sharing the broker. See the Apache Security Mailing List Thread and the Openwall OSS-Security Discussion for coordinated disclosure details.

No public proof-of-concept code has been released. The vulnerability manifests within the disposition frame handling path of Qpid Broker-J. Refer to the vendor advisory for technical specifics rather than synthetic exploitation samples.

Detection Methods for CVE-2026-68077

Indicators of Compromise

Sustained CPU saturation on Qpid Broker-J Java processes without a corresponding increase in legitimate message throughput
Authenticated AMQP sessions transmitting disposition frames with abnormally large or inverted range values
Broker thread pool exhaustion and delayed acknowledgements for unrelated client sessions
Client timeouts and connection resets clustered around a single authenticated principal

Detection Strategies

Enable AMQP protocol logging on the broker and inspect disposition frame range fields for outliers relative to normal message volume
Correlate per-principal CPU consumption with disposition frame frequency to isolate abusive sessions
Monitor JVM garbage collection and thread state metrics for sustained high utilization tied to session dispatcher threads

Monitoring Recommendations

Alert on Qpid Broker-J CPU utilization exceeding baseline for more than a short observation window
Track authenticated session counts alongside disposition frame rates per session to detect anomalous patterns
Ingest broker logs and JVM metrics into a centralized SIEM for retention and cross-session correlation

How to Mitigate CVE-2026-68077

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0, which contains the fix for CVE-2026-68077
Audit AMQP account credentials and revoke unused or shared authentication material that could enable abuse
Restrict broker exposure to trusted network segments while upgrade planning is underway

Patch Information

The Apache Qpid project fixed the issue in Qpid Broker-J 10.1.0. Administrators running any release through 10.0.1 should upgrade without delay. Release artifacts and change notes are referenced in the Apache Security Mailing List Thread.

Workarounds

Limit AMQP access to authenticated principals from known application hosts using network access control lists
Apply per-connection resource quotas and session limits in the broker configuration to reduce blast radius
Terminate sessions exhibiting anomalous disposition frame patterns and rotate the associated credentials

bash

# Configuration example
# Verify running Apache Qpid Broker-J version and upgrade to 10.1.0
java -jar qpid-broker.jar --version
# After upgrade, confirm the broker reports version 10.1.0 or later