Apache Qpid Broker-J EUVD-2026-86583

Exploitation requires only network reachability to the broker's AMQP 0-8/0-9/0-9-1 protocol listener; the flaw is triggered pre-authentication in field-table processing, so no credentials, user interaction, or non-default configuration is needed on a broker that exposes these legacy AMQP protocol versions (default for the qpid-broker-plugins-amqp-0-8-protocol plugin) through version 10.1.0. The primary limiting factor is exposure of the AMQP port: brokers restricted to trusted internal networks or configured to disable the 0-8/0-9/0-9-1 protocol plugin are not remotely reachable by arbitrary attackers, and impact is limited to availability (broker crash), with no data disclosure or code execution.

This is a pre-authentication remote denial-of-service in Apache Qpid Broker-J's AMQP 0-8/0-9/0-9-1 field-table parser, where unbounded type nesting drives uncontrolled recursion into a StackOverflowError. No CVSS vector, EPSS score, KEV entry, or public exploit was provided in the input, so quantitative exploitation signals are entirely absent - all severity reasoning is inferred from the description and Apache's 'important' rating. The impact profile is favorable for an attacker on one axis: exploitation is explicitly stated to occur pre-authentication over the AMQP network protocol, which normally implies AV:N/PR:N/UI:N and low attack complexity, making the trigger trivially reachable on any exposed broker. However, the impact is confined to availability (crash/DoS) with no confidentiality or integrity consequence, so this is a real-but-bounded priority: worth prompt patching for internet- or partner-facing brokers, but not a code-execution or data-exposure emergency. Note the discrepancy that no CVSS was assigned by NVD or the vendor - the 'important' label is Apache's qualitative judgment; teams should treat the ~7.5 estimate below as analyst-derived, not authoritative. Exploitation status: no public exploit identified at time of analysis.

An attacker who can reach the broker's AMQP listener (no credentials required) opens a connection and sends a crafted frame containing an AMQP field-table with deeply nested type structures. The parser recurses without a depth bound and exhausts the JVM thread stack, throwing a StackOverflowError that disrupts broker processing and denies service to legitimate messaging clients. No public proof-of-concept is referenced, but the low complexity and pre-auth network reachability make weaponization straightforward.