What is the CVSS score of EUVD-2026-53087?

EUVD-2026-53087 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Broker-J are affected by EUVD-2026-53087?

Apache Qpid Broker-J versions through 10.0.1 contain a denial-of-service vulnerability allowing authenticated users to exhaust broker resources and cause service outages.

How to fix or mitigate EUVD-2026-53087?

Within 24 hours: Inventory all Qpid Broker-J instances running versions 10.0.1 or earlier, audit authentication configuration, and review broker logs for abnormal session behavior. Within 7 days: Deploy per-session resource quotas and connection rate limiting on affected brokers, restrict AMQP client access to approved applications, and enable monitoring alerts for unusual resource consumption. Within 30 days: Evaluate newer Qpid versions or alternative message brokers without this vulnerability; if upgrading is not feasible, implement layered application-level controls to further restrict broker session creation.

Apache Qpid Broker-J EUVD-2026-53087

| CVE-2026-68075 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-05 apache

GHSA-9jp6-xx3c-j9w5

Apache Denial Of Service Apache Qpid Broker J

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable broker, low complexity; PR:L because authentication is required; pure availability impact with no C/I effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 07:02 vuln.today

CVE Published

Aug 05, 2026 - 05:36 cve.org

HIGH

DescriptionCVE.org

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

AnalysisAI

Denial of service in Apache Qpid Broker-J through 10.0.1 allows authenticated session participants to exhaust broker resources by deliberately exceeding the AMQP session flow control incoming window. The broker fails to enforce adequate limits on resource allocation when a session window is overflowed, enabling a malicious but authenticated client to destabilize or crash the broker. No public exploit code exists at time of analysis, and no confirmed active exploitation has been reported.

Technical ContextAI

Apache Qpid Broker-J is a Java-based AMQP message broker implementing versions 0-9-1 and 1.0 of the Advanced Message Queuing Protocol (AMQP). AMQP includes a session-layer flow control mechanism using credit-based windows to regulate the rate of message transfer between peers. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the broker does not enforce a hard cap when a remote session peer sends data beyond its declared incoming window, allowing unbounded resource consumption. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_qpid_broker-j:*:*:*:*:*:*:*:*, covering all releases through 10.0.1.

RemediationAI

Vendor-released patch: 10.1.0. Upgrade Apache Qpid Broker-J to version 10.1.0 as directed by the vendor advisory at https://lists.apache.org/thread/lht725jgkowmyyjl039roffg6pyvbxz0. If immediate upgrade is not feasible, restrict AMQP broker access to only fully trusted, internally controlled clients using network ACLs or broker-level authentication policy, ensuring no semi-trusted or third-party clients can establish sessions. Additionally, configure broker-level connection and session limits where supported to reduce the blast radius of any single session. These compensating controls do not eliminate the underlying flaw and should be treated as temporary measures until patching is complete.