What is the CVSS score of CVE-2026-68073?

CVE-2026-68073 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Broker-J are affected by CVE-2026-68073?

Apache Qpid Broker-J through version 10.0.1 is vulnerable to unauthenticated remote denial of service, allowing attackers to crash any accessible broker instance by exploiting uncontrolled recursion…

How to fix or mitigate CVE-2026-68073?

Within 24 hours, conduct an inventory of all Apache Qpid Broker-J deployments and document current versions to identify affected instances and network exposure from untrusted sources. Within 7 days, apply the vendor-released patch to upgrade all instances to version 10.1.0 or later, prioritizing brokers handling business-critical message flows. Within 30 days, complete post-patch validation testing to confirm message routing and dependent applications function correctly, and update vulnerability management records to confirm remediation.

Apache Qpid Broker-J CVE-2026-68073

EUVD-2026-53083 HIGH

Uncontrolled Recursion (CWE-674)

2026-08-05 apache

GHSA-q9g7-9jxr-wq49

Denial Of Service Apache Apache Qpid Broker J Apache Software Foundation

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (apache) PRIMARY

HIGH

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-authentication network reachability with no complexity or interaction; impact confined to availability as StackOverflowError causes DoS without code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 18:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 18:37 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 18:37 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 07:00 vuln.today

CVE Published

Aug 05, 2026 - 05:32 cve.org

HIGH

DescriptionNVD

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

AnalysisAI

Unauthenticated remote denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting uncontrolled recursion during type-nesting processing, which exhausts the JVM call stack and triggers a StackOverflowError. The attack requires no credentials and no user interaction against any reachable broker instance. No public exploit identified at time of analysis; EPSS of 0.19% (9th percentile) indicates low real-world exploitation probability. Vendor-released patch: 10.1.0.

Technical ContextAI

Apache Qpid Broker-J is a Java-based AMQP message broker maintained by the Apache Software Foundation (CPE: cpe:2.3:a:apache_software_foundation:apache_qpid_broker-j:*:*:*:*:*:*:*:*). The root cause is CWE-674 (Uncontrolled Recursion): the broker's type-parsing or message-deserialization logic does not enforce a maximum recursion depth when processing nested type structures in inbound AMQP frames. A sufficiently deep nesting chain causes the JVM to exhaust its thread call stack, producing a StackOverflowError that terminates or destabilizes the broker process. This class of flaw is common in parsers that rely on recursive descent without explicit depth guards.

RemediationAI

Upgrade to Apache Qpid Broker-J version 10.1.0, which resolves the uncontrolled recursion flaw per the vendor advisory at https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr. If immediate upgrade is not feasible, restrict network access to the AMQP listener ports (typically 5672/TCP and 5671/TCP for TLS) to only trusted, authenticated clients using firewall ACLs or network segmentation - this does not eliminate the vulnerability but prevents unauthenticated remote exploitation. Note that network-level restriction may impact legitimate messaging clients and does not protect against insider or compromised-client scenarios.