Improper handling of compressed data in the shared GZIP decompressor used for AMQP protocol message delivery and HTTP management allows an authenticated message producer to send large or maliciously compressed payloads that are processed without an explicit limit on the uncompressed payload size. This can exhaust broker memory and effectively make the broker unavailable, leading to denial‑of‑service conditions.

The issue affects all Apache Qpid Broker-J releases up to and including version 10.1.0. Customers running those versions are at risk until they upgrade to the fixed 10.1.1 release or later.

The vulnerability is classified as a resource‑management flaw (CWE‑409) with a CVSS score of 6.5. The EPSS score is < 1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. However, the lack of a decompressed‑output limit means that authenticated producers can use this weakness to consume memory. The attacker requires authentication with the broker and can trigger the failure by repeatedly sending compressed messages; no additional network privileges beyond normal message‑production rights are required. The impact is a local denial of service to the broker service, potentially affecting all connected clients.