What’s Vulnerable › Vulnerabilities

CVE-2026-68078: Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-24
• Weakness: CWE-770

Description

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Qpid Broker-J: before 10.1.0 — fixed in 10.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Qpid Broker-J 10.1.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/m8gs6pfp1fmbgwcjr8zsgn95hfh15f8o
• http://www.openwall.com/lists/oss-security/2026/08/04/19

Get alerted when CVE-2026-68078 or the next vulnerability affects your stack