CVE-2026-92560
published 2026-09-25CVE-2026-92560: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
40.7th percentile
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 10.1.1 | 10.1.1 |
| apache_software_foundation | apache_qpid_broker-j | <= 10.1.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Qpid Broker-J AMQP 0-10 Decoder allocation of resources
vuldb·2026-09-25
CVE-2026-92560 [CRITICAL] Apache Qpid Broker-J AMQP 0-10 Decoder allocation of resources
A vulnerability was found in Apache Qpid Broker-J. It has been classified as critical. This affects an unknown function of the component AMQP 0-10 Decoder. This manipulation causes allocation of resources.
This vulnerability appears as CVE-2026-92560. The attack may be initiated remotely. There is no available exploit.
GHSA
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
ghsa_unreviewed·2026-09-25
CVE-2026-92560 [HIGH] CWE-770 A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Red Hat
org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder
vendor_redhat·2026-09-25·CVSS 7.5
CVE-2026-92560 [HIGH] CWE-770 org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder
org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder
A flaw was found in Apache Qpid Broker-J within the Advanced Message Queuing Protocol (AMQP) 0-10 decoder component. An unauthenticated remote attacker could exploit improper type size and count handling by sending specially crafted network messages. This can trigger excessive memory allocation, resulting in a Denial of Service (DoS) due to resource exhaustion.
Statement: This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger unbounded memory allocation, leading to process exhaustion and service termination without requiring authentication. In Red Hat environments such as Red Hat JBoss F
No detection rules found.
No public exploits indexed.
2026-09-25
Published