CVE-2026-92550
published 2026-09-25CVE-2026-92550: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
40.7th percentile
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 10.1.1 | 10.1.1 |
| apache_software_foundation | apache_qpid_broker-j | <= 10.1.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
ghsa_unreviewed·2026-09-25
CVE-2026-92550 [HIGH] CWE-789 A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
VulDB
Apache Qpid Broker-J AMQP Decoder allocation of resources
vuldb·2026-09-25
CVE-2026-92550 [CRITICAL] Apache Qpid Broker-J AMQP Decoder allocation of resources
A vulnerability has been found in Apache Qpid Broker-J and classified as critical. The affected element is an unknown function of the component AMQP Decoder. The manipulation leads to allocation of resources.
This vulnerability is documented as CVE-2026-92550. The attack can be initiated remotely. There is not any exploit available.
Red Hat
qpid-java: org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP decoder
vendor_redhat·2026-09-25·CVSS 7.5
CVE-2026-92550 [HIGH] CWE-770 qpid-java: org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP decoder
qpid-java: org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP decoder
A flaw was found in Apache Qpid Broker-J. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted messages with manipulated type size or count parameters to the AMQP (Advanced Message Queuing Protocol) decoder. This causes excessive memory allocation, leading to a Denial of Service (DoS) by exhausting available system resources.
Statement: This vulnerability is rated as Important because unauthenticated remote attackers can exhaust host memory without possessing valid credentials, resulting in a total loss of broker availability. In typical Red Hat deployments, such as distributed integration wor
No detection rules found.
No public exploits indexed.
2026-09-25
Published