CVE-2026-68073 - Vulnerability Details - OpenCVE

Description

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Published: 2026-08-05

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability allows a pre‑authentication attacker to create an arbitrary depth of nested type definitions that can trigger a StackOverflowError in Apache Qpid Broker‑J. The stack overflow can crash the broker process, resulting in a denial of service. This flaw is identified as CWE‑674, indicating uncontrolled recursion or resource exhaustion.

Affected Systems

Apache Qpid Broker‑J from the Apache Software Foundation is affected in all releases through 10.0.1. The vendor recommends upgrading to version 10.1.0, which contains the fix.

Risk and Exploitability

The flaw is exploitable before any authentication is performed, and no EPSS score is available to quantify current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, but its impact on availability and the ability to crash the broker make it a high‑risk issue. Attackers would need network access to the broker and the ability to send messages that include nested type definitions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Qpid Broker-J

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.0.1

No data.

No data.

Vendor Product Confidence Versions

Apache

Qpid Broker-j

95%

Version	Status	Scheme	Platform
`[0,10.0.1]`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Apache Qpid Broker‑J to version 10.1.0 or later
Restrict network access to the broker by configuring firewall rules that allow only trusted IPs to connect
Apply OS or container resource limits (e.g., stack size) to mitigate stack overflow effects

Generated by OpenCVE AI on August 5, 2026 at 08:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00193.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr

History

Wed, 05 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache qpid Broker-j
Vendors & Products		Apache Apache qpid Broker-j

Wed, 05 Aug 2026 06:30:00 +0000

Type	Values Removed	Values Added
Description		A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Title		Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
Weaknesses		CWE-674
References		https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr

Subscriptions

Apache Qpid Broker-j

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-08-05T05:32:25.113Z

Updated: 2026-08-05T06:58:24.614Z

Reserved: 2026-07-30T08:58:06.373Z

Link: CVE-2026-68073

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-05T09:00:05Z

Weaknesses

CWE-674
Uncontrolled Recursion

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68073", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-07-30T08:58:06.373Z", "datePublished": "2026-08-05T05:32:25.113Z", "dateUpdated": "2026-08-05T06:58:24.614Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol", "product": "Apache Qpid Broker-J", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "10.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.0.1.</div><div>Users are recommended to upgrade to version 10.1.0, which fixes the issue.</div>"}], "value": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.0.1.\n\nUsers are recommended to upgrade to version 10.1.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-05T05:32:25.113Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/04/15"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-05T06:58:24.614Z"}}]}}