What is the CVSS score of CVE-2026-68077?

CVE-2026-68077 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Broker-J are affected by CVE-2026-68077?

Apache Qpid Broker-J through version 10.0.1 contains a critical vulnerability allowing authenticated users to exhaust broker CPU resources via malformed AMQP frames, potentially disabling message…

How to fix or mitigate CVE-2026-68077?

Within 24 hours, identify all systems running Apache Qpid Broker-J versions 10.0.1 or earlier and assess which brokers handle production messaging. Within 7 days, apply the vendor-released patch to upgrade all vulnerable instances to version 10.1.0, testing functionality in a staging environment before production rollout. Within 30 days, confirm all Qpid brokers in production are running 10.1.0 or later, review AMQP client authentication policies to ensure least-privilege access, and validate broker performance metrics have returned to baseline.

Apache Qpid Broker-J CVE-2026-68077

EUVD-2026-53091 MEDIUM

Unchecked Input for Loop Condition (CWE-606)

2026-08-04

GHSA-4j92-6h2x-83rf

Apache Denial Of Service Qpid Broker J

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable broker (AV:N), straightforward once authenticated (AC:L), valid credentials required (PR:L), availability-only impact (A:H), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 16:22 NVD

CRITICAL MEDIUM

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (CRITICAL) 6.5 (MEDIUM)

Analysis Generated

Aug 04, 2026 - 20:28 vuln.today

CVE Published

Aug 04, 2026 - 18:59 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker CPU resources by sending crafted disposition frames containing large or illegal delivery-ID ranges. The broker's naive range iteration logic processes these ranges without bounds enforcement, causing excessive CPU consumption that degrades or halts message brokering for all connected clients. No public exploit code and no confirmed active exploitation are known at time of analysis; vendor-released fix 10.1.0 is available.

Technical ContextAI

Apache Qpid Broker-J is a pure-Java AMQP 1.0 message broker maintained by the Apache Software Foundation (Maven artifact org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol). In the AMQP 1.0 protocol, a 'disposition' performative is used by a receiver to settle (acknowledge or reject) message deliveries by specifying a delivery-ID range. The vulnerable code path within the AMQP 1.0 protocol plugin does not impose upper bounds when iterating over the delivery-ID range provided in an incoming disposition frame, allowing an attacker to specify pathologically large or structurally illegal ranges. This forces the broker into excessive iteration, consuming CPU cycles without productive work - a pattern consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-834 (Excessive Iteration), though no formal CWE mapping was provided in the advisory. No CPE string was supplied, but the affected artifact is unambiguously identified as org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol.

RemediationAI

Upgrade Apache Qpid Broker-J to version 10.1.0, which contains the fix for unbounded disposition range handling; this is the only confirmed remediation per the Apache advisory (https://seclists.org/oss-sec/2026/q3/418). No documented workarounds exist in the advisory. As compensating controls pending upgrade, operators should restrict AMQP connection access exclusively to trusted, known service accounts using broker authentication policy or network-level ACLs, reducing the pool of potential authenticated attackers. If the broker configuration supports per-connection or per-session resource quotas (such as message rate limits or connection throttling), enabling these may limit the CPU impact of malformed frames at the cost of added latency for legitimate clients. Minimizing broker exposure to internal networks and auditing active AMQP client credentials to remove stale or overly permissioned accounts further reduces risk. See https://qpid.apache.org/ for release downloads.