Security feed

24 October 2026

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92564

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92564

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92564
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #3818 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:41:03 GMT
Publisher date: Fri, 25 Sep 2026 07:59:30 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92608

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92608

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92608
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #2126 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:13:16 GMT
Publisher date: Fri, 25 Sep 2026 07:44:26 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92609

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92609

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92609
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #2078 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:46 GMT
Publisher date: Fri, 25 Sep 2026 07:44:10 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92573

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92573

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92573
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #2063 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:36 GMT
Publisher date: Fri, 25 Sep 2026 08:11:12 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92560

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92560

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92560
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #2062 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:35 GMT
Publisher date: Fri, 25 Sep 2026 08:17:01 GMT

Read the original announcement

advisoryUnratedOfficial CVE List24 Oct 2026

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

Announced 25 Sept 2026

Apache Qpid Broker-J CVE-2026-92550

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92550

Apache Qpid Broker-J

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92550
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #2045 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:12:23 GMT
Publisher date: Fri, 25 Sep 2026 08:17:38 GMT

Read the original announcement