CVE-2026-68074

Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

Published Aug 5, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Analysis

Technical impact

Apache Qpid Broker-J contains a flaw that allows an attacker to send protocol messages before authentication, causing the broker to unboundedly cache symbol values. This results in rapid consumption of memory or CPU resources, eventually exhausting the broker’s resources and causing a denial of service. The weakness is identified as CWE‑770, reflecting unchecked resource consumption.

Affected Systems

Apache Qpid Broker‑J versions through 10.0.1 are affected. Versions 10.1.0 and later are not impacted.

Risk and Exploitability

The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog, indicating a low publicly known exploitation probability. However, the CVSS score of 7.5 denotes a high severity risk to availability. The vulnerability can be triggered before authentication by sending crafted protocol messages, meaning unauthenticated users can initiate resource exhaustion if the broker is exposed to the network.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Qpid Broker-J

unaffected

Version	Status	Constraints
`0`	affected	≤ 10.0.1

Configuration 1 [-]

cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Qpid Broker-j

Version	Status	Scheme	Platform
`[0,10.0.1]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Qpid Broker‑J to version 10.1.0, which removes the unbounded caching behavior.
Restart the broker service to ensure the new version is loaded and active.
Monitor resource usage on the broker to detect abnormal memory or CPU consumption that may indicate exploitation attempts.

Generated by OpenCVE AI on August 6, 2026 at 17:04 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.774% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/08/04/16
https://lists.apache.org/thread/9t1pvl36z69ssww6449od5g0tszqnhjs

History

Aug 6, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 5, 2026 6:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache qpid Broker-j
Vendors & Products		Apache Apache qpid Broker-j

Aug 5, 2026 5:30 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Title		Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
Weaknesses		CWE-770
References		https://lists.apache.org/thread/9t1pvl36z69ssww6449od5g0tszqnhjs