CVE-2026-68077
Received Received - Intake

Denial of Service in Apache Qpid Broker-J

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-68077
EUVD
EUVD-2026-53091

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache qpid_broker_j to 10.1.0 (exc)
apache qpid_broker_j 10.1.0
apache qpid_broker_j to 10.0.1 (inc)
apache qpid_broker_j to 10.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated attacker to send a specially crafted disposition frame with large or illegal ranges to an Apache Qpid Broker-J server. The server's naive handling of these ranges causes excessive CPU usage, leading to a denial of service condition where the system becomes unresponsive or slow.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive CPU usage or unusual network traffic patterns. Check Qpid Broker-J logs for repeated disposition frame errors or high CPU load. Use system monitoring tools like top, htop, or sar to identify abnormal CPU consumption by the Qpid process.

Impact Analysis

If you use Apache Qpid Broker-J versions up to 10.0.1, an attacker with valid credentials could exploit this flaw to consume excessive server resources. This may result in degraded performance, system crashes, or prolonged downtime for your messaging services.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. It primarily causes denial of service through excessive CPU usage, which may indirectly affect system availability but does not involve data breaches or unauthorized access.

Mitigation Strategies

Immediately upgrade Apache Qpid Broker-J to version 10.1.0 or later. If upgrading is not immediately possible, restrict access to authenticated users only and monitor for suspicious frame submissions. Apply network-level protections to filter malformed frames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart