CVE-2026-92564

Analyzed Analyzed - Analysis Complete

Stack Overflow Error in Apache Qpid Broker-J

Publication date: 2026-09-25

Last updated on: 2026-10-05

Assigner: Apache Software Foundation

Description

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-92564

EUVD

EUVD-2026-86583

Affected Vendors & Products

Vendor	Product	Version / Range
apache	qpid_broker-j	to 10.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability allows a pre-authentication attacker to exploit unbounded type nesting in AMQP 0-8/0-9/0-9-1 field-table processing. This triggers a StackOverflowError, which can lead to a denial of service by crashing the Apache Qpid Broker-J service.

Detection Guidance

Detecting this vulnerability requires checking the Apache Qpid Broker-J version in use. Run the command: qpid-broker --version. If the output shows a version through 10.1.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to crash the Apache Qpid Broker-J service, causing downtime and disrupting message brokering operations. This may lead to loss of service for applications relying on the broker.

Compliance Impact

This vulnerability is a denial of service risk via StackOverflowError due to unbounded type nesting in AMQP field-table processing. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged denial of service could indirectly affect compliance by disrupting access to critical systems handling personal or health data.

Mitigation Strategies

Upgrade Apache Qpid Broker-J to version 10.1.1 or later immediately. This version fixes the type nesting issue causing the StackOverflowError.

Hi! I’m here to help you understand CVE-2026-92564. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70