Denial of Service in Apache Qpid Broker-J via Uncontrolled Recursion

Apache Qpid Broker-J versions through 10.0.1 contain a vulnerability (CVE-2026-68073) classified as CWE-674 (Uncontrolled Recursion). This flaw allows a pre-authentication attacker to send specially crafted network requests containing deeply nested data structures to the broker. The processing of these nested types causes the application to enter an uncontrolled recursive state, ultimately resulting in a StackOverflowError. This condition forces the Apache Qpid Broker-J service to crash, creating a denial of service (DoS) condition. The vulnerability affects the AMQP 1-0 protocol implementation within the broker.

Impact

Successful exploitation of this vulnerability results in the complete loss of availability for the targeted Apache Qpid Broker-J service. As the attack is possible without authentication, any actor with network reach to the broker's management or messaging interface can trigger the crash, disrupting critical messaging queues and downstream integrated applications.

Recommendation

• Upgrade Apache Qpid Broker-J to version 10.1.0 or later immediately to address the underlying recursion logic flaw.
• Evaluate network access controls to ensure the Qpid Broker-J management and messaging ports are restricted to authorized source IP addresses.
• Monitor logs for repeated service restarts or crash dumps consistent with StackOverflowError exceptions in the JVM process.