What is the CVSS score of CVE-2026-68060?

CVE-2026-68060 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Broker-J are affected by CVE-2026-68060?

Apache Qpid message brokers (versions ≤10.0.1) are vulnerable to complete service unavailability through remote denial-of-service attacks that require no credentials or specialized knowledge,…

How to fix or mitigate CVE-2026-68060?

Within 24 hours: identify all Qpid Broker-J instances at version 10.0.1 or earlier in production, and immediately deploy firewall rules restricting AMQP protocol access (ports 5672/5671) to explicitly authorized internal networks only, disabling direct internet exposure. Within 7 days: configure per-broker connection rate limiting and anomaly detection to block or alert on malformed AMQP protocol patterns; establish monitoring dashboards tracking memory usage, connection counts, and broker restart events; review Apache Qpid release channels for patch availability beyond 10.0.1. Within 30 days: execute upgrade to a confirmed patched version if available, or formalize a 12-month remediation plan combining permanent network segmentation, automated failover procedures, and architectural review for alternative message brokers; document all compensating controls in incident response playbooks.

Apache Qpid Broker-J CVE-2026-68060

EUVD-2026-53056 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-05 apache

GHSA-x379-jmr7-h8qf

Denial Of Service Apache Apache Qpid Broker J Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-auth network path with no complexity; only availability impact via unbounded allocation; no scope change, confidentiality, or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 22:49 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 06, 2026 - 22:48 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:53 vuln.today

CVE Published

Aug 05, 2026 - 05:26 cve.org

HIGH

DescriptionCVE.org

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

AnalysisAI

Unauthenticated denial-of-service in Apache Qpid Broker-J through 10.0.1 allows any network-reachable attacker to crash or hang the broker by sending crafted AMQP protocol messages that exploit improper type size/count validation, triggering unbounded memory allocation. The flaw resides in the pre-authentication protocol parsing path, requiring no credentials, user interaction, or special configuration. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.19% (9th percentile) indicates minimal observed exploitation activity despite the straightforward attack vector.

Technical ContextAI

Apache Qpid Broker-J is a Java-based AMQP 1.0 message broker developed under the Apache Software Foundation, commonly used in enterprise messaging architectures. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_qpid_broker-j:*:*:*:*:*:*:*:*, covering all releases from the initial version through 10.0.1. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the broker fails to bound or validate type size and count fields received during AMQP framing before performing memory allocation, meaning a maliciously constructed value can instruct the broker to allocate arbitrarily large memory regions. Because this occurs in the pre-authentication code path - before any credential verification - the full attack surface is exposed to any host that can reach the broker's AMQP listening port.

RemediationAI

Upgrade Apache Qpid Broker-J to version 10.1.0, which contains the official fix per the Apache advisory at https://lists.apache.org/thread/0slvl8h25w3z4opnh08yyn8l3chko5c9. If an immediate upgrade is operationally infeasible, restrict inbound access to the AMQP listening ports (typically TCP 5672 for unencrypted and TCP 5671 for TLS) at the network perimeter or host firewall to only known, trusted client IP ranges; this reduces the attack surface to adversaries who have already gained network adjacency and does not eliminate the vulnerability, but prevents unauthenticated external exploitation. Enabling mutual TLS authentication at the broker boundary is an additional layer that forces clients to present valid certificates before protocol framing begins, though this requires certificate infrastructure and may impact existing clients. No other workarounds are documented in available advisories.