The vulnerability is an uncontrolled recursion flaw that allows a pre‑authentication attacker to create an arbitrary depth of nested type definitions, leading to a StackOverflowError that can crash the Apache Qpid Broker‑J process. This loss of process availability aligns with the CWE‑674 classification for uncontrolled recursion or resource exhaustion. The immediate consequence is a denial of service that impacts the broker's ability to accept or process client connections.

Apache Qpid Broker‑J from the Apache Software Foundation is affected in all releases up to and including version 10.0.1. The vendor recommends upgrading to version 10.1.0 to receive the fix.

Based on the description, it is inferred that a remote attacker who can send crafted messages to the broker before authentication could trigger the flaw; the CVSS score of 7.5 indicates high severity, and the EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The lack of authentication needed for exploitation and the potential to crash the broker process mean that any network access to the broker that permits message submission poses a significant risk.