Apache Qpid Broker-J CVE-2026-92573

Requires valid AMQP producer (publish) credentials on the broker, since exploitation occurs during message delivery/conversion - this is the primary limiting factor (not unauthenticated). The vulnerable path is the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering, which processes compressed input with no decompressed-output cap; any Qpid Broker-J deployment through 10.1.0 that accepts compressed messages is affected. No special non-default toggle is documented - the missing decompression limit is the default behavior - but an attacker must be authorized to produce messages, bounding realistic exposure to insiders, compromised clients, or brokers granting broad publish rights.

No CVSS vector, EPSS score, KEV entry, or public PoC is supplied for CVE-2026-92573, so exploitation-probability signals are entirely absent - no evidence of active exploitation and none should be inferred. The Apache advisory rates it 'important' and the mechanics are clear: an authenticated AMQP message producer sends compressed data that the shared GZIP decompressor inflates without a decompressed-output limit (a classic decompression/zip-bomb resource-consumption flaw, CWE-400), exhausting broker memory. My independent read of the vector is AV:N/AC:L/PR:L/UI:N with availability-only impact - a real but bounded denial-of-service issue, not a code-execution or data-disclosure event. The key limiting factor is that valid producer credentials are required (PR:L), so this is not an unauthenticated internet-wide threat; it is primarily a risk from insider or compromised-client abuse and from any broker that grants publish rights broadly. Verdict: a legitimate patch-worthy availability bug, but its practical priority is moderate - driven by impact class and auth requirement, not by any confirmed exploitation signal, all of which are missing from the input.

An attacker holding valid AMQP producer credentials (or a compromised client) publishes crafted, highly-compressed messages to the broker; when Qpid Broker-J's shared GZIP decompressor inflates them for delivery, message conversion, or HTTP management JSON rendering, memory is consumed without bound and the broker is starved and disrupted. No public exploit code is identified at time of analysis, and the network/low-complexity/low-privilege profile makes reliable triggering straightforward for any authorized producer.