Apache Qpid Broker-J CVE-2026-68078

Exploitation requires a valid, authenticated AMQP 1.0 connection to the Qpid Broker-J instance - the attacker must hold credentials accepted by the broker's configured authentication provider. The vulnerability is specific to the AMQP 1.0 protocol plugin; AMQP 0-x protocol paths are not implicated. No special feature flag or non-default configuration is required beyond the AMQP 1.0 plugin being loaded, which is standard for Broker-J deployments. What limits exploitation is the authentication barrier: unauthenticated external attackers without valid credentials cannot reach the vulnerable code path. Abuse requires standard AMQP 1.0 client capabilities (initiating deliveries and sending transfer frames), so no exploit tooling beyond a conformant AMQP 1.0 library is needed once credentials are obtained.

No CVSS vector or EPSS score was provided, limiting quantitative comparison of risk signals. The description explicitly states that exploitation requires an authenticated attacker, confirming that unauthenticated external parties cannot directly reach the vulnerable code path - this substantially reduces the exploitable surface relative to an unauthenticated network flaw. The sole confirmed impact is availability (DoS); no confidentiality or integrity impact is described. Apache rates the severity as 'important' rather than 'critical,' consistent with an authenticated denial-of-service with no data exposure. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog, and no POC exploit code has been identified at time of analysis. Real-world risk is moderate for deployments where AMQP 1.0 credentials are broadly issued or shared among many clients, since any credentialed client - including a compromised or malicious insider - could abuse the flaw to take the broker offline. Environments where broker access is tightly restricted to a small set of vetted service accounts face lower practical risk.

An authenticated AMQP 1.0 client - for example a compromised service account or a malicious insider - connects to the Qpid Broker-J and initiates a delivery, deliberately fragmenting the message payload into an extremely large number of transfer frames without terminating the delivery. By sustaining this across one or more concurrent sessions, the attacker causes the broker to accumulate unbounded in-memory state, exhausting heap and CPU resources until the broker becomes unresponsive and legitimate messaging clients lose connectivity.