Apache Qpid Broker-J CVE-2026-92550

Exploitation requires network access to a Qpid Broker-J instance (through 10.1.0) that exposes an AMQP 0-8/0-9/0-9-1 protocol listener; the malformed type size/count frame is processed by the decoder BEFORE authentication, so no credentials, user interaction, or non-default configuration are needed as long as a legacy AMQP 0-8/0-9/0-9-1 listener is enabled and reachable. The primary limiting factors are: the broker must be network-reachable by the attacker (mitigated if the AMQP port is firewalled to trusted clients), and the affected protocol path is specifically the AMQP 0-8/0-9/0-9-1 decoder - deployments using only AMQP 1.0 may not be on this code path. Impact is limited to availability (crash/resource exhaustion); no data disclosure or code execution results.

This is a pre-authentication denial-of-service in the AMQP 0-8/0-9/0-9-1 protocol decoder of Apache Qpid Broker-J, where attacker-controlled type size/count fields drive excessive memory allocation (classic CWE-770 uncontrolled resource allocation). No CVSS vector, CWE, EPSS, KEV, or POC data is provided by any source, so quantitative exploitation signals are entirely absent - the only severity anchor is Apache's own qualitative rating of 'important'. Reconstructing the vector, the flaw is remotely reachable before authentication with low complexity and no user interaction, but impact is confined to availability (A:H, no confidentiality/integrity), yielding an assessed ~7.5. Real-world risk is moderate and product-scoped: exploitation is trivial in principle (send malformed AMQP frames to an exposed broker port) but the payoff is only a crash/resource-exhaustion DoS, not code execution or data theft, and Qpid Broker-J has a limited deployment footprint. No public exploit is identified at time of analysis and there is no evidence of active exploitation, so this is a patch-in-normal-cycle issue rather than an emergency - with the caveat that brokers exposing AMQP listeners to untrusted networks should prioritize the upgrade because the pre-auth reachability removes any authentication barrier.

An attacker with network reach to an exposed Qpid Broker-J AMQP listener sends a crafted AMQP 0-8/0-9/0-9-1 frame containing oversized type size or element-count values before authenticating. The decoder trusts these values and pre-allocates a large buffer or collection, exhausting heap memory and driving the broker to OutOfMemory/crash, denying messaging service to legitimate clients. No public exploit code is identified at time of analysis, but the attack requires no credentials and only low complexity.