CVE-2026-92560

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92560", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-16T13:25:51.418Z", "datePublished": "2026-09-25T08:17:01.277Z", "dateUpdated": "2026-09-25T13:11:31.985Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T08:17:01.277Z"}, "title": "Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder", "problemTypes": [{"descriptions": [{"description": "CWE-770 Allocation of resources without limits or throttling", "lang": "en", "cweId": "CWE-770", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol", "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "10.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/13"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T09:12:50.497Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T13:10:39.137588Z", "id": "CVE-2026-92560", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:11:31.985Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/13"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T09:12:50.497Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-92560", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T13:10:39.137588Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:10:25.397Z"}}], "cna": {"title": "Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "n0mi1k"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.1.0"}], "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<div>A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T08:17:01.277Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92560", "state": "PUBLISHED", "dateUpdated": "2026-09-25T13:11:31.985Z", "dateReserved": "2026-09-16T13:25:51.418Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-25T08:17:01.277Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-10-protocol", "packageURL": "pkg:maven/org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol", "product": "Apache Qpid Broker-J", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "10.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*", "matchCriteriaId": "952FA6B1-8568-468F-B6D2-311F977B2138", "versionEndExcluding": "10.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}], "id": "CVE-2026-92560", "lastModified": "2026-10-05T18:06:34.563", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92560", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T13:10:39.137588Z", "version": "2.0.3"}}]}, "published": "2026-09-25T09:17:06.587", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/24/13"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.qpid/qpid-broker-plugins-amqp-0-10-protocol: Apache Qpid Broker-J: Denial of Service via excessive memory allocation in AMQP 0-10 decoder", "id": "2540985", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540985"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Apache Qpid Broker-J within the Advanced Message Queuing Protocol (AMQP) 0-10 decoder component. An unauthenticated remote attacker could exploit improper type size and count handling by sending specially crafted network messages. This can trigger excessive memory allocation, resulting in a Denial of Service (DoS) due to resource exhaustion."], "mitigation": {"lang": "en:us", "value": "Restrict access to the AMQP broker service port (default TCP port 5672 or 5671) to trusted networks or localhost using firewall controls.\nTo limit access to authorized client subnets using firewalld:\n1. Remove unrestricted public access to the AMQP port:\n# firewall-cmd --zone=public --remove-port=5672/tcp --permanent\n2. Allow access only from trusted source IP addresses or subnets:\n# firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> --permanent\n3. Apply the firewall configuration:\n# firewall-cmd --reload\nCaveat: Blocking public broker port access will prevent any external or unlisted clients from connecting to the messaging service. Verify that all legitimate application endpoints and client networks are added to the trusted zone.\nWarning: Reloading firewall rules may temporarily disrupt active network sessions or client connections."}, "name": "CVE-2026-92560", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "qpid-broker-plugins-amqp-0-10-protocol", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-25T08:17:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92560\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92560\nhttps://lists.apache.org/thread/dcsjw242n1bxdog29hwlg43r5611dtb7"], "statement": "This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger unbounded memory allocation, leading to process exhaustion and service termination without requiring authentication. In Red Hat environments such as Red Hat JBoss Fuse, the affected AMQP 0-10 protocol plugin is utilized within messaging broker integration components. Risk is primarily present in deployments where the broker listener is exposed directly to untrusted networks.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Qpid Broker-J", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "qpid_broker-j", "vendor": "apache"}], "created": "2026-09-25T09:45:17.462233+00:00", "updated": "2026-09-26T00:30:19.195606+00:00", "vendors": ["apache", "apache$PRODUCT$qpid_broker-j"]}