Apache Qpid Broker-J EUVD-2026-86586

Exploitation requires network reachability to a broker running the AMQP 0-10 protocol plugin (org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol) at version 10.1.0 or earlier; the attacker crafts frames with malicious type size/count values that the 0-10 decoder processes before authentication. No credentials, user interaction, or non-default authentication is needed - the vulnerable code path is reached pre-authentication. Limiting factors: the AMQP 0-10 protocol handler must be enabled and the broker's AMQP port must be exposed to the attacker; deployments that only enable AMQP 1.0/0-9-1 or restrict network access to the broker are correspondingly less exposed. Impact is limited to availability (broker DoS) with no data exposure or modification.

This is a pre-authentication denial-of-service via uncontrolled memory allocation (type size/count mishandling) in the AMQP 0-10 protocol decoder of Apache Qpid Broker-J through 10.1.0. No NVD CVSS vector, CWE, EPSS score, KEV entry, or public exploit was provided, so raw prioritization signals are largely absent - the only severity anchor is Apache's own rating of 'important'. My independent assessment places this at CVSS 3.1 ~7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): the flaw is remotely reachable before authentication over the AMQP protocol port, which is the aggravating factor, but the impact is confined to availability (crash/OOM) with no confidentiality or integrity loss. Net real-world risk is moderate rather than critical: the pre-auth network reach makes it easy to trigger against any exposed broker, yet the single-impact DoS ceiling and the niche footprint of a pure-Java AMQP broker cap the blast radius. Exploitation status is 'no public exploit identified at time of analysis' - absence of EPSS/KEV/POC data means widespread opportunistic exploitation cannot be inferred; treat as a patch-soon issue for internet-exposed brokers rather than an emergency. Note: no machine-readable CVSS was supplied by NVD or the vendor, so the vector above is analyst-derived and should be verified against the eventual NVD/CNA record.

An attacker who can reach the broker's AMQP 0-10 listener sends a crafted protocol frame with manipulated type size or element-count fields before completing authentication. The decoder trusts these values and attempts an excessive memory allocation, exhausting the JVM heap and crashing or hanging the broker, denying messaging service to all legitimate clients. No public exploit code was identified at time of analysis.