CVE-2026-92573
published 2026-09-25CVE-2026-92573: Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.41%
34.4th percentile
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_broker-j | < 10.1.1 | 10.1.1 |
| apache_software_foundation | apache_qpid_broker-j | <= 10.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Qpid Broker-J AMQP Decompression resource consumption
vuldb·2026-09-25
CVE-2026-92573 [CRITICAL] Apache Qpid Broker-J AMQP Decompression resource consumption
A vulnerability, which was classified as critical, was found in Apache Qpid Broker-J. Impacted is an unknown function of the component AMQP Decompression/Message Conversion/HTTP Management JSON Rendering. Executing a manipulation can lead to resource consumption.
This vulnerability is registered as CVE-2026-92573. It is possible to launch the attack remotely. No exploit is available.
GHSA
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authentica
ghsa_unreviewed·2026-09-25
CVE-2026-92573 [MEDIUM] CWE-409 Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authentica
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-25
Published