The vulnerability allows an attacker to construct deeply nested type structures within AMQP 0-8/0-9/0-9-1 field tables. When the broker processes these structures before any authentication, it can trigger a StackOverflowError that terminates the broker or leaves it in an unstable state, effectively denying service to legitimate clients.

Apache Qpid Broker-J versions through 10.1.0 are affected. The issue is present in all installations using the default AMQP protocol handling prior to the fix shipped in 10.1.1.

The exploit requires the attacker to send a specially crafted AMQP message; no authentication is necessary. The EPSS score indicates a very low exploitation probability (< 1%) and the vulnerability is not listed in CISA’s KEV catalog, but the impact of causing a broker crash is significant for any environment where Qpid provides critical messaging services. The CVSS score is 7.5, indicating a high severity level for the denial-of-service attack arising from lack of authentication barriers.