What’s Vulnerable › Vulnerabilities

CVE-2026-68080: Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-24
• Weakness: CWE-406

Description

It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Qpid Broker-J: before 10.1.0 — fixed in 10.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Qpid Broker-J 10.1.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/tcnrv5nhmnsrzz92o4owxgycro6llt57
• http://www.openwall.com/lists/oss-security/2026/08/04/20

Get alerted when CVE-2026-68080 or the next vulnerability affects your stack