EUVD-2026-86582
GHSA-vvvh-6236-74pm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as message producer
-
DeliveryCraft AMQP 1.0 message with malformed properties
-
ExploitPublish to broker
-
ExecutionTrigger uncaught exception in 0-10 encoder
-
ImpactDisrupt delivery to AMQP 0-10 consumers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Requires the broker to bridge protocols: an AMQP 1.0 producer path feeding AMQP 0-10 consumers, so message conversion between the two protocols must be in use. The attacker must be an authenticated message producer able to publish messages (the description says 'authenticated,' contradicting the vector's PR:N). Exploitation is limited to environments actually running mixed AMQP 1.0 / 0-10 messaging on Qpid Broker-J at or below version 10.1.0; brokers without 0-10 consumers on the conversion path are not affected. No user interaction is required. |
| Impact | Signals converge on this being a genuine-but-moderate availability issue rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 driven entirely by A:H, with no confidentiality or integrity impact. EPSS is very low (0.16%, 4th percentile), there is no CISA KEV listing, and no public exploit code was identified - all pointing to low real-world exploitation likelihood. A key conflict exists: the CVSS vector asserts PR:N (unauthenticated), but the description explicitly states 'authenticated message producers,' so PR:N appears wrong and should be PR:L - verify with the Apache Qpid advisory. The 'Information Disclosure' tag also conflicts with the vector (C:N/I:N), which describes a pure denial-of-service. CWE-248 (uncaught exception) is consistent with a delivery-disruption DoS. Net: a real DoS worth patching on exposed brokers, but not a high-urgency, mass-exploited threat. |
| Exploit ScenarioDerived | An attacker who already holds valid producer credentials on a Qpid Broker-J instance publishes an AMQP 1.0 message crafted with property values whose encoding the AMQP 0-10 converter mishandles. When the broker attempts to convert and deliver the message to AMQP 0-10 consumers, an uncaught encoding exception is raised, disrupting message delivery on that path. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Denial of service in Apache Qpid Broker-J through 10.1.0 allows an authenticated AMQP 1.0 message producer to disrupt message delivery to AMQP 0-10 consumers by publishing messages carrying properties that the AMQP 1.0-to-0-10 conversion encoder cannot encode. The impact is limited to brokers actually bridging the two protocol generations - an AMQP 1.0 producer path feeding AMQP 0-10 consumers must be in use for the flaw to be reachable - and no public exploit code or confirmed active exploitation has been identified at time of analysis. EPSS is 0.16% (4th percentile), consistent with a genuine but moderate availability issue; the vendor has released Qpid Broker-J 10.1.1 as the fix.
Earlier versions of this analysis (1)
Message delivery disruption in Apache Qpid Broker-J through 10.1.0 allows an authenticated remote message producer to break delivery of messages to AMQP 0-10 consumers by sending AMQP 1.0 messages whose properties trigger an unhandled encoding exception during protocol conversion. Only deployments that run the bundled AMQP 1.0-to-AMQP 0-10 conversion path (qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0) with AMQP 1.0 producers feeding AMQP 0-10 consumers are exposed, and exploitation requires valid broker credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - availability-only impact). No public exploit code was identified at time of analysis and there is no CISA KEV listing, so risk is moderate: the vendor has released 10.1.1 as the fix and the impact is confined to denial of message delivery, with no confidentiality or integrity effect.
RemediationAI
Vendor-released patch: upgrade Apache Qpid Broker-J to version 10.1.1, which fixes the improper exception handling in the AMQP 1.0-to-AMQP 0-10 property encoder; see the vendor site at https://qpid.apache.org/ and the release announcement at https://lists.apache.org/thread/rklst4cz1g0nkpzkpho7kjmy4gnx1ppc (background at https://seclists.org/oss-sec/2026/q3/931). If an immediate upgrade is not possible, the most effective compensating control is architectural: stop routing AMQP 1.0 producer traffic to AMQP 0-10 consumers so the vulnerable conversion path is never exercised - this fully removes exposure but requires reconfiguring brokers, bindings, or client protocols and may break existing cross-protocol integrations. Where the conversion path must stay in place, restrict publish permissions so that only tightly trusted, well-behaved producers (and ideally only producers whose message property sets are known to encode cleanly) can publish onto queues that are bridged to 0-10 consumers, and prefer source-validated allow-lists over blanket write ACLs; the trade-off is reduced flexibility for legitimate onboarding of new producers. Operators should also add queue-depth and consumer-stall alerting on the 0-10 side so that any delivery disruption caused by a malformed property is detected quickly, and monitor for repeated publish failures or encoder exceptions in broker logs, which can indicate deliberate probing. None of these workarounds remove the underlying code defect, so patching to 10.1.1 remains the recommended action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-248 (Uncaught Exception), reached inside the Apache Qpid Broker-J message-conversion layer that translates AMQP 1.0 messages into the AMQP 0-10 representation. When a producer publishes a message whose property set includes an element the 0-10 encoder does not support or cannot correctly serialize, the encoder raises an exception that is not handled by the conversion path, breaking delivery to the affected 0-10 consumers rather than being converted, degraded, or rejected cleanly. The vulnerability therefore sits in the interoperability/bridging code that exists only when a broker serves both AMQP 1.0 producers and AMQP 0-10 consumers; a deployment using a single AMQP version on the publish/consume path does not exercise the vulnerable encoder. The published CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), driven entirely by availability impact with no confidentiality or integrity loss; our independent assessment retains the network, low-complexity, no-user-interaction, availability-only profile but scores it PR:L (authenticated), because the description explicitly describes the attacker as an authenticated message producer, which contradicts the PR:N value in the published vector. Either way, the attacker must already hold publish rights on an AMQP 1.0 path that feeds 0-10 consumers.
Know when Qpid Broker J gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description states authenticated producers, so PR:L not PR:N; network-reachable AMQP with low complexity; pure availability loss on the conversion path, hence C:N/I:N/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Organizations running Apache Qpid Broker-J up to 10.1.0 with a message path that bridges AMQP 1.0 producers to AMQP 0-10 consumers face a high-severity availability risk (CVE-2026-92608), where a producer can publish content that the protocol-conversion encoder cannot process, disrupting message delivery for downstream AMQP 0-10 consumers. Exposure is limited to brokers actually performing this cross-protocol conversion, so most Qpid deployments are likely out of scope; no public exploit code or confirmed active exploitation has been identified at time of analysis. Leadership attention should focus on confirming whether the affected bridge configuration exists in production and on scheduling the vendor fix rather than on incident response.
Apply vendor patch (Qpid Broker-J 10.1.1). Until the upgrade is complete, restrict and monitor AMQP 1.0 producer access to brokers performing AMQP 1.0-to-0-10 conversion, and disable that bridging path in production where it is not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Qpid Broker J
View allIn Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on differ
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated at
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to b
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame si
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth
Unauthenticated remote denial of service in Apache Qpid Broker-J through 10.1.0, where a crafted AMQP 0-8/0-9/0-9-1 fiel
Pre-authentication denial of service in Apache Qpid Broker-J through 10.1.0: a remote attacker who can reach a broker wi
Pre-authentication denial of service in Apache Qpid Broker-J (through 10.1.0) allows a remote attacker to exhaust broker
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which all
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 clie
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker
Exploit-DB