Cpe:2.3:a:apache:qpid_broker-J:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aapacheqpid_broker-j/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 06 Aug 2026 19:26:24 +0000Denial of Service in Apache Qpid Broker-J via Uncontrolled Recursionhttps://feed.craftedsignal.io/briefs/2026-08-qpid-dos/Thu, 06 Aug 2026 19:26:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-qpid-dos/Apache Qpid Broker-J versions through 10.0.1 are vulnerable to a pre-authentication denial of service attack where an attacker triggers a StackOverflowError through crafted type nesting.Apache Qpid Broker-J versions through 10.0.1 contain a vulnerability (CVE-2026-68073) classified as CWE-674 (Uncontrolled Recursion). This flaw allows a pre-authentication attacker to send specially crafted network requests containing deeply nested data structures to the broker. The processing of these nested types causes the application to enter an uncontrolled recursive state, ultimately resulting in a StackOverflowError. This condition forces the Apache Qpid Broker-J service to crash, creating a denial of service (DoS) condition. The vulnerability affects the AMQP 1-0 protocol implementation within the broker.

Impact

Successful exploitation of this vulnerability results in the complete loss of availability for the targeted Apache Qpid Broker-J service. As the attack is possible without authentication, any actor with network reach to the broker's management or messaging interface can trigger the crash, disrupting critical messaging queues and downstream integrated applications.

Recommendation

  • Upgrade Apache Qpid Broker-J to version 10.1.0 or later immediately to address the underlying recursion logic flaw.
  • Evaluate network access controls to ensure the Qpid Broker-J management and messaging ports are restricted to authorized source IP addresses.
  • Monitor logs for repeated service restarts or crash dumps consistent with StackOverflowError exceptions in the JVM process.
]]>lowadvisorydenial-of-servicecve-2026-68073apache