CVE-2026-68078: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68078 Overview

CVE-2026-68078 affects Apache Qpid Broker-J through version 10.0.1. The broker does not govern the maximum number of transfer frames permitted per incoming delivery. An authenticated attacker can abuse this behavior to trigger excessive resource consumption and cause a denial of service on the broker. The issue is tracked under CWE-770, Allocation of Resources Without Limits or Throttling. Apache recommends upgrading to version 10.1.0, which enforces limits on transfer frames per delivery.

Critical Impact
An authenticated user on the network can exhaust broker resources by sending unbounded transfer frames, degrading or halting message delivery for all connected clients.

Affected Products

Apache Qpid Broker-J versions up to and including 10.0.1
Deployments exposing AMQP endpoints to authenticated network clients
Messaging platforms and integrations dependent on Qpid Broker-J

Discovery Timeline

2026-08-05 - CVE-2026-68078 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68078

Vulnerability Analysis

Apache Qpid Broker-J implements the Advanced Message Queuing Protocol (AMQP). AMQP allows a single logical message delivery to be split across multiple transfer frames. The broker accepts and buffers these frames until the delivery is complete. Prior to version 10.1.0, the broker did not cap the number of transfer frames it would accept for a single delivery. An authenticated client can open a session, initiate a delivery, and stream transfer frames indefinitely. Each accepted frame consumes memory and processing capacity on the broker. Sustained abuse forces the broker into resource exhaustion, disrupting service for legitimate consumers and producers.

Root Cause

The defect is a missing input boundary check on the AMQP transfer frame count per delivery. Without an upper bound, the broker treats client-supplied frame streams as trusted and unbounded. This maps directly to [CWE-770]: Allocation of Resources Without Limits or Throttling.

Attack Vector

Exploitation requires valid broker credentials and network reachability to the AMQP listener. The attacker establishes an authenticated AMQP session, begins a message transfer, and continues to emit transfer frames without signaling completion. No user interaction is required, and the scope remains unchanged. Confidentiality and integrity are not directly affected, but availability of the broker is impacted.

No verified public proof-of-concept code exists for this issue. Refer to the Apache Mailing List Update and the OpenWall OSS Security Post for the vendor's technical description.

Detection Methods for CVE-2026-68078

Indicators of Compromise

Broker processes showing sustained memory growth tied to a single AMQP session or connection
AMQP sessions with abnormally high transfer frame counts without corresponding delivery completions
Client connections producing large volumes of transfer performatives without terminal frames

Detection Strategies

Instrument the broker to log per-session transfer frame counts and flag sessions exceeding operational baselines
Correlate authentication events with connection metrics to identify accounts that generate anomalous frame volume
Alert on broker JVM heap pressure, garbage collection storms, or thread saturation aligned with active AMQP sessions

Monitoring Recommendations

Track Qpid Broker-J metrics for message delivery duration, incomplete deliveries, and per-connection buffer sizes
Forward broker and authentication logs to a centralized analytics platform to detect resource-exhaustion patterns
Baseline normal producer behavior and alert on deviations in frame count, delivery size, and session lifetime

How to Mitigate CVE-2026-68078

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0 or later on all broker nodes
Audit AMQP user accounts and rotate credentials for any account showing anomalous activity
Restrict AMQP listener exposure to trusted network segments and known client ranges

Patch Information

Apache has released Apache Qpid Broker-J version 10.1.0, which introduces a limit on the maximum number of transfer frames per incoming delivery. Details are published in the Apache Mailing List Update and the OpenWall OSS Security Post.

Workarounds

Enforce network-level access controls that limit AMQP connectivity to vetted producer applications
Apply per-user connection quotas and rate limits at the broker or an upstream proxy
Monitor broker resource usage and terminate sessions that exceed defined frame or memory thresholds until the patch is applied

bash

# Verify installed Apache Qpid Broker-J version and upgrade
./qpid-server --version
# Upgrade to 10.1.0 or later, then restart the broker service
systemctl restart qpidd