CVE-2026-92564

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92564", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-16T13:32:35.140Z", "datePublished": "2026-09-25T07:59:30.710Z", "dateUpdated": "2026-09-29T16:07:02.432Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T07:59:30.710Z"}, "title": "Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing", "problemTypes": [{"descriptions": [{"description": "CWE-674 Uncontrolled Recursion", "lang": "en", "cweId": "CWE-674", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "10.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T08:14:48.610Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T13:23:29.728672Z", "id": "CVE-2026-92564", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T16:07:02.432Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/24/14"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-25T08:14:48.610Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-92564", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T13:23:29.728672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T13:22:21.767Z"}}], "cna": {"title": "Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "n0mi1k"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Broker-J", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.1.0"}], "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<div>A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.</div><div>This issue affects Apache Qpid Broker-J: through 10.1.0.</div><div>Users are recommended to upgrade to version 10.1.1, which fixes the issue.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-25T07:59:30.710Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92564", "state": "PUBLISHED", "dateUpdated": "2026-09-29T16:07:02.432Z", "dateReserved": "2026-09-16T13:32:35.140Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-25T07:59:30.710Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol", "product": "Apache Qpid Broker-J", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "10.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*", "matchCriteriaId": "952FA6B1-8568-468F-B6D2-311F977B2138", "versionEndExcluding": "10.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Broker-J: through 10.1.0.\n\nUsers are recommended to upgrade to version 10.1.1, which fixes the issue."}], "id": "CVE-2026-92564", "lastModified": "2026-10-05T18:04:01.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92564", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T13:23:29.728672Z", "version": "2.0.3"}}]}, "published": "2026-09-25T09:17:06.717", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory", "Mailing List"], "url": "https://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/24/14"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.qpid/qpid-broker-plugins-amqp-0-8-protocol: Apache Qpid Broker-J: Denial of Service via unbounded type nesting", "id": "2540988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540988"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Apache Qpid Broker-J. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted messages containing deeply nested data structures during protocol handling. Because the broker does not properly restrict type nesting depth, processing these payloads triggers a stack overflow error, causing the service to crash."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the broker's AMQP listening ports (by default, TCP port 5672 or port 5671 for TLS) so that only authorized, trusted systems can connect.\nFor example, using firewalld to permit access only from a trusted management or application subnet (e.g., 192.168.1.0/24):\n# firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"5672\" protocol=\"tcp\" accept'\n# firewall-cmd --reload\nWarning: Applying firewall rules may interrupt existing client sessions and requires reloading the firewall service. Test rule changes in a staging environment to ensure necessary messaging traffic is not inadvertently blocked."}, "name": "CVE-2026-92564", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "qpid-broker-plugins-amqp-0-8-protocol", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-25T07:59:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92564\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92564\nhttp://www.openwall.com/lists/oss-security/2026/09/24/14\nhttps://lists.apache.org/thread/hw4jkngtkzf0dxdj9mv3z2p71mkpjvx4"], "statement": "This vulnerability is rated as Important because an unauthenticated remote client can trigger a denial of service on the broker service without requiring valid credentials or user interaction. In typical Red Hat deployments incorporating Qpid components, exposing broker endpoints directly to untrusted networks allows external parties to crash the service via deeply nested message structures. Red Hat products operating in restricted or isolated network architectures face reduced overall exposure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.1.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Qpid Broker-J", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "qpid_broker-j", "vendor": "apache"}], "created": "2026-09-25T09:45:17.462624+00:00", "updated": "2026-09-26T02:15:03.032537+00:00", "vendors": ["apache", "apache$PRODUCT$qpid_broker-j"]}