Description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T09:17:06.447Z",
  "pubdate": "2026-09-25T09:17:06.447Z",
  "executiveSummary": "Apache Qpid Broker-J is susceptible to a denial-of-service (DoS) vulnerability originating from improper handling of type size and count parameters within incoming network frames. This vulnerability allows an unauthenticated, remote attacker to trigger excessive memory allocation, potentially exhausting system resources and leading to service instability or process termination.\nThe vulnerability affects Apache Qpid Broker-J versions up to and including 10.1.0. The flaw stems from insufficient validation of input metadata during the initial stages of frame processing, before authentication occurs. By manipulating type size or count fields within the protocol handshake or message delivery sequences, an attacker can force the broker to attempt the allocation of arbitrary memory blocks.\nSuccessful exploitation requires network connectivity to the broker's listening port. Due to the pre-authentication nature of this flaw, no valid credentials or session state are required to initiate the attack. The primary impact is the loss of availability, which may manifest as heap exhaustion, out-of-memory (OOM) errors, or severe latency degradation. Organizations utilizing affected versions of Apache Qpid Broker-J should prioritize upgrading to version 10.1.1 or later to remediate the underlying logic error in resource allocation management.",
  "technicalDetails": "The root cause of this vulnerability lies in the broker's handling of specific protocol frames, where the logic responsible for deserializing type size and count metadata fails to impose adequate bounds or sanity checks. When the Apache Qpid Broker-J receives a request, it attempts to parse the length headers or count fields associated with AMQP or related protocol frames. If these fields contain maliciously crafted or excessively large values, the broker's memory management subsystem allocates resources based on these untrusted inputs before authentication is performed.\nThe attack flow begins when an attacker establishes a TCP connection to the Apache Qpid Broker-J service. Prior to completing any authentication handshake, the attacker sends a protocol-compliant frame containing a manipulated header that specifies an extremely large size or count. Because the broker performs memory reservation prematurely, it attempts to satisfy the allocation request from the heap. An attacker can repeatedly trigger this behavior with multiple concurrent connections, leading to rapid heap fragmentation or total exhaustion of available memory.\nThe vulnerable component involves the packet parsing and framing layer, which is responsible for translating wire-format data into object-oriented representations. This component lacks the necessary input validation checks to verify that the size/count fields remain within defined operational limits for the associated data structures. Because the broker does not enforce a maximum threshold for these parameters at the entry point, it remains highly vulnerable to resource exhaustion attacks.\nThe post-exploitation impact is primarily Denial of Service. When the broker experiences an OOM condition, it may trigger an aggressive garbage collection cycle, causing significant CPU overhead and response latency. In more severe cases, the process may be terminated by the Operating System's OOM killer, resulting in total service interruption for all legitimate clients. As this occurs in the pre-authentication phase, there is no requirement for user privileges or prior interaction with the message bus, making the attack surface significantly exposed to any entity capable of reaching the network port of the broker."
}