CVE-2026-68080: Apache Qpid Broker-J DoS Vulnerability

CVE-2026-68080 Overview

CVE-2026-68080 affects Apache Qpid Broker-J versions through 10.0.1. The broker fails to govern the rate at which it responds to an echo flow. An authenticated attacker can abuse this behavior to trigger excessive resource consumption and cause a denial of service against the messaging broker.

The issue maps to [CWE-406: Insufficient Control of Network Message Volume (Network Amplification)]. Exploitation requires low privileges and network access, but no user interaction. Apache has released version 10.1.0 to remediate the flaw.

Critical Impact
An authenticated adversary can exhaust broker resources by driving unbounded echo flow responses, degrading or halting messaging services that depend on Apache Qpid Broker-J.

Affected Products

Apache Qpid Broker-J versions up to and including 10.0.1
Deployments exposing AMQP endpoints to authenticated users
Message brokers relying on Qpid Broker-J for enterprise messaging

Discovery Timeline

2026-08-05 - CVE-2026-68080 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68080

Vulnerability Analysis

Apache Qpid Broker-J is a pure-Java implementation of the Advanced Message Queuing Protocol (AMQP) broker. AMQP defines flow-control primitives that allow peers to signal readiness for additional messages. Echo flow requests instruct the peer to reply with an updated flow state.

The broker processes incoming echo flow requests without enforcing a rate limit on outgoing responses. An authenticated client can submit echo flows at a high frequency and force the broker to allocate CPU, memory, and I/O resources for each reply. Sustained submission degrades broker throughput and can render the service unavailable to legitimate clients.

The flaw is a resource management issue rather than a memory safety bug. It does not compromise confidentiality or integrity, but availability impact is high on affected deployments.

Root Cause

The root cause is the absence of rate governance on echo flow response generation inside the broker's flow-control handler. The code path treats every echo flow as a valid request and produces a corresponding reply without accounting for per-session or per-connection quotas.

Attack Vector

An attacker requires valid credentials on the broker. From an authenticated AMQP session, the attacker issues echo flow frames in a tight loop across one or more sessions. The broker's reply generation consumes resources proportional to the request rate, leading to service degradation or denial of service for other tenants and applications.

See the Apache Security Mailing List Thread and the Openwall OSS Security Discussion for the vendor announcement.

Detection Methods for CVE-2026-68080

Indicators of Compromise

Sudden spikes in AMQP frame throughput from a single authenticated principal or client IP address
Broker log entries showing sustained echo flow processing from one session
Elevated CPU utilization on the Qpid Broker-J JVM without a corresponding increase in published messages
Client connection timeouts or delivery latency spikes affecting unrelated tenants

Detection Strategies

Instrument broker metrics to track echo flow frame counts per connection and per session
Alert on connections whose flow-control frame rate exceeds baseline thresholds for the environment
Correlate broker CPU saturation with active session inventories to identify offending clients
Review authentication logs to attribute abusive sessions to specific accounts or service identities

Monitoring Recommendations

Ship Qpid Broker-J logs and JVM metrics to a centralized SIEM for anomaly detection
Track resource exhaustion patterns using time-series baselines for CPU, heap, and thread counts
Monitor authenticated AMQP sessions for abnormal frame ratios between control and data traffic

How to Mitigate CVE-2026-68080

Immediate Actions Required

Upgrade Apache Qpid Broker-J to version 10.1.0 or later on all broker nodes
Rotate credentials for accounts that authenticate to affected brokers, especially shared service accounts
Restrict broker network exposure to trusted client subnets until patching is complete
Review authentication policies to ensure only required identities can open AMQP sessions

Patch Information

Apache has released Qpid Broker-J version 10.1.0, which fixes the echo flow rate governance issue. Administrators should follow the upgrade procedure documented by the Apache Qpid project and validate broker health after deployment. See the Apache Security Mailing List Thread for release details.

Workarounds

Apply network-level rate limiting between clients and the broker to cap AMQP frame throughput
Enforce least-privilege authentication so that only trusted producers and consumers can connect
Isolate high-value queues on dedicated broker instances to limit blast radius from a compromised account
Terminate sessions that generate anomalous control-frame volume during incident response

bash

# Verify installed Apache Qpid Broker-J version
./qpid-server --version

# Upgrade to the fixed release (example, adapt to your deployment)
wget https://downloads.apache.org/qpid/broker-j/10.1.0/binaries/apache-qpid-broker-j-10.1.0-bin.tar.gz
tar -xzf apache-qpid-broker-j-10.1.0-bin.tar.gz