An authenticated attacker can send a disposition frame containing large or illegal ranges, which the broker processes with naive range handling. The resulting excessive CPU consumption leads to denial of service for the Qpid broker. The core weakness is the lack of bounds checking in range processing, classified as CWE‑606. Only an attacker who has valid credentials can craft such frames, but once authenticated, all packets from that source can saturate the broker’s resources.

Apache Qpid Broker‑J supplied by the Apache Software Foundation is affected for all releases up to and including 10.0.1. Versions 10.1.0 and later contain the fix. Any installation of the broker that relies on 10.0.1 or older is potentially vulnerable.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread public exploitation has been observed yet. The CVSS score of 6.5 indicates a moderate severity, meaning an authenticated attacker can trigger an outage if the broker is not patched. The attack vector is likely an authenticated internal or compromised client that can send arbitrary disposition frames, and the exploit requires no additional software beyond the broker itself. Given the lack of external attack surface, the risk is primarily to environments where trusted clients have access to the broker and could be abused by malicious insiders or compromised credentials.