EUVD-2026-53087
GHSA-9jp6-xx3c-j9w5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable broker, low complexity; PR:L because authentication is required; pure availability impact with no C/I effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Broker-J: through 10.0.1.
Users are recommended to upgrade to version 10.1.0, which fixes the issue.
AnalysisAI
Denial of service in Apache Qpid Broker-J through 10.0.1 allows authenticated session participants to exhaust broker resources by deliberately exceeding the AMQP session flow control incoming window. The broker fails to enforce adequate limits on resource allocation when a session window is overflowed, enabling a malicious but authenticated client to destabilize or crash the broker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated AMQP session on the Apache Qpid Broker-J instance - the attacker must hold valid credentials or an existing authorized connection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided by the reporter, so severity must be inferred from the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 10.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Qpid Broker-J instances running versions 10.0.1 or earlier, audit authentication configuration, and review broker logs for abnormal session behavior. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Qpid Broker J
View allRemote unauthenticated denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiti
Unauthenticated remote denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiti
Unauthenticated denial-of-service in Apache Qpid Broker-J through 10.0.1 allows any network-reachable attacker to crash
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today