The issue stems from improper handling of property-encoding exceptions during conversion from AMQP 1.0 to AMQP 0-10, allowing producers with valid credentials to inject messages containing properties that trigger a failure in the target encoder. As a result, AMQP 0-10 consumers experience delivery disruption, affecting the availability of the messaging service while leaving confidentiality and integrity intact.

Apache Qpid Broker-J versions up to and including 10.1.0 are affected; users must check whether their installations are running any of these versions.

The vulnerability is not listed in CISA KEV and its EPSS score is not available, suggesting limited exploit evidence so far. However, because the attack can be carried out by any authenticated message producer, the condition for exploitation is that the attacker can obtain valid producer credentials. An attacker could craft a message with problematic properties to cause conversion errors on consumers, thereby disrupting message delivery. The lack of publicly reported exploits reduces the immediate risk, but the vulnerability can still be abused if the producer can authenticate to the broker.