What is the CVSS score of CVE-2026-68074?

CVE-2026-68074 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Broker-J are affected by CVE-2026-68074?

Apache Qpid Broker-J versions 10.0.1 and earlier are vulnerable to unauthenticated remote denial-of-service attacks that can crash or hang the message broker service without requiring any…

How to fix or mitigate CVE-2026-68074?

Within 24 hours, inventory all Qpid Broker-J instances to identify version and network exposure (internet-facing vs. internal), and enable monitoring for connection floods or DoS patterns on AMQP ports. Over the next 7 days, implement firewall rules and network access controls restricting broker access to authorized internal networks and required clients only, enable connection rate limiting on the broker if available, and audit recent logs for suspicious activity. Within 30 days, monitor Apache Qpid vendor advisories for patch availability and establish a staged testing plan for deployment, evaluate alternative message queuing solutions if network isolation cannot adequately reduce risk, and maintain heightened monitoring for DoS indicators on all production systems.

Apache Qpid Broker-J CVE-2026-68074

EUVD-2026-53052 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-05 apache

GHSA-xwj4-vp42-mgvj

Denial Of Service Apache Apache Qpid Broker J Apache Software Foundation

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-authentication network attack with no interaction; only availability is impacted via heap exhaustion, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 14:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 14:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:53 vuln.today

CVE Published

Aug 05, 2026 - 05:19 cve.org

HIGH

DescriptionCVE.org

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

AnalysisAI

Remote unauthenticated denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting unbounded symbol value caching in the AMQP message processing layer. A pre-authentication attacker can exhaust broker resources without supplying any credentials, crashing or hanging the service. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.21% (11th percentile) indicates low exploitation probability at time of analysis, though the network-accessible, zero-complexity attack path keeps it a meaningful patching priority for exposed deployments.

Technical ContextAI

Apache Qpid Broker-J is a Java-based AMQP (Advanced Message Queuing Protocol) message broker supporting AMQP 1.0, 0-10, 0-9, and 0-8. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): during AMQP frame parsing, the broker caches symbol values received from clients to optimize repeated lookups, but no upper bound is enforced on the cache size. An attacker sending frames that continuously introduce novel, unique symbol values forces the broker to grow its symbol cache indefinitely, exhausting JVM heap memory. Because this parsing occurs before any authentication exchange, no credentials are required. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_qpid_broker-j:*:*:*:*:*:*:*:*, covering all releases from initial version through 10.0.1.

RemediationAI

Vendor-released patch: version 10.1.0. Upgrade Apache Qpid Broker-J to 10.1.0 as directed by the Apache security advisory at https://lists.apache.org/thread/9t1pvl36z69ssww6449od5g0tszqnhjs; this is the only confirmed fix. If immediate upgrade is not feasible, restrict network access to the AMQP listener ports (TCP 5672 plaintext and 5671 TLS) at the firewall or load-balancer level so only trusted, authenticated clients can establish connections - this eliminates the pre-authentication attack surface but requires network-layer enforcement and may be incompatible with broker topologies that serve external clients. Additionally, JVM heap limits can be tuned downward to cause faster OOM failures that trigger process restart via a supervisor rather than a slow, unresponsive hang, though this trades reliability for faster recovery and does not prevent the attack itself.