CVE-2026-92550— Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder
Quick assessment
Affected
Apache Software Foundation Apache Qpid Broker-J
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在身份验证之前，攻击者可能利用类型大小/计数处理缺陷，导致过度分配，从而引发潜在的服务拒绝攻击（Denial of Service, DoS）。 此问题影响 Apache Qpid Broker-J 10.1.0 及更早版本。 建议用户升级至版本 10.1.1，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92550
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder
Source: CVE Program / CVE List V5
Vulnerability Description
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Qpid Broker-J | 0 ~ 10.1.0 | - |
|
II. Public POCs for CVE-2026-92550
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92550
请登录查看更多情报信息。
Other References for CVE-2026-92550 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-25 · 6 CVEs total
| CVE-2026-92560 | Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authen | |
| CVE-2026-92573 | Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression | |
| CVE-2026-92564 | Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication | |
| CVE-2026-92608 | Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 | |
| CVE-2026-92609 | Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication |
IV. Related Vulnerabilities
Same product: Apache Qpid Broker-J
-
CVE-2026-92560
Apache Qpid Broker-J: Type size/count handling can lead to e -
CVE-2026-92573
Apache Qpid Broker-J: Uncontrolled resource consumption duri -
CVE-2026-92564
Apache Qpid Broker-J: Unbounded type nesting can lead to sta -
CVE-2026-92608
Apache Qpid Broker-J: Incomplete property conversion handlin -
CVE-2026-92609
Apache Qpid Broker-J: Missing HTTP-session renewal after suc
Same vendor: Apache Software Foundation
-
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch -
CVE-2026-90979
Apache Karaf: LDAP filter injection in JAAS LDAP login modul -
CVE-2026-86507
Apache Roller: Stored XSS in comment moderation via comment -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-82380
Apache Roller: CSRF protection bypass via self-generated sal
Same weakness: CWE-789
-
CVE-2026-96260
Mattermost server missing request body size limit on plugin -
CVE-2026-77322
SIPGO: DoS via unvalidated WebSocket frame length -
CVE-2026-58268
SIPGO: DoS via unvalidated Content-Length in the stream pars -
CVE-2026-59991
psd-tools: Uncontrolled memory allocation in psd-tools compo -
CVE-2026-94626
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL t
V. Comments for CVE-2026-92550
No comments yet