CVE-2026-92564
published 2026-09-25CVE-2026-92564: A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.48%
40.7th percentile
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 10.1.1 | 10.1.1 |
| apache_software_foundation | apache_qpid_broker-j | <= 10.1.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting
vendor_redhat·2026-09-25·CVSS 7.5
CVE-2026-92564 [HIGH] CWE-770 org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting
org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting
A flaw was found in Apache Qpid Broker-J. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted messages containing deeply nested data structures during protocol handling. Because the broker does not properly restrict type nesting depth, processing these payloads triggers a stack overflow error, causing the service to crash.
Statement: This vulnerability is rated as Important because an unauthenticated remote client can trigger a denial of service on the broker service without requiring valid credentials or user interaction. In typical Red Hat deployments incorporating Qpid components, exposing broker endpoints directly to
VulDB
Apache Qpid Broker-J Field-Table Processing stack-based overflow
vuldb·2026-09-25
CVE-2026-92564 [CRITICAL] Apache Qpid Broker-J Field-Table Processing stack-based overflow
A vulnerability was found in Apache Qpid Broker-J. It has been rated as critical. Affected is an unknown function of the component Field-Table Processing. Performing a manipulation results in stack-based buffer overflow.
This vulnerability is known as CVE-2026-92564. Remote exploitation of the attack is possible. No exploit is available.
GHSA
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
ghsa_unreviewed·2026-09-25
CVE-2026-92564 CWE-674 A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
2026-09-25
Published