Description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T09:17:06.587Z",
  "pubdate": "2026-09-25T09:17:06.587Z",
  "executiveSummary": "Apache Qpid Broker-J is susceptible to a denial-of-service (DoS) vulnerability caused by improper handling of type size and count parameters in incoming network data.\nThis vulnerability is classified as an improper resource allocation issue, which can be exploited by a remote, unauthenticated attacker.\nBy sending a maliciously crafted payload, an attacker can trigger excessive memory allocation within the broker's process, leading to resource exhaustion, application instability, or a complete crash.\nThe vulnerability affects Apache Qpid Broker-J versions through 10.1.0.\nGiven that the attack is pre-authentication, it poses a significant risk to the availability of the messaging infrastructure, as no valid credentials or session management is required to initiate the attack.\nSuccessful exploitation results in service unavailability, disrupting dependent messaging services and potentially impacting downstream applications that rely on the broker for asynchronous communication.",
  "technicalDetails": "The vulnerability exists within the Apache Qpid Broker-J protocol handling logic, specifically concerning how the broker parses and processes type size and object count fields from incoming AMQP frames or related protocol headers.\nThe root cause of this vulnerability lies in the broker's failure to adequately validate or bound the values provided for type sizes or object counts before allocating corresponding memory buffers.\nWhen a network packet arrives at the broker, the parser reads the specified size/count header. If this value is abnormally large, the application attempts to reserve a memory block proportional to the requested size without cross-referencing it against available system resources, configured memory limits, or the actual size of the incoming data stream.\nAn unauthenticated attacker can exploit this by crafting a malicious protocol frame where the size/count header is set to a near-maximum integer value. Upon reception, the broker's allocation routines (e.g., heap allocation for buffer queues or object arrays) receive this large value as a request for memory.\nThe attack flow follows a straightforward progression: 1) The attacker initiates a connection to the exposed broker network port. 2) The attacker transmits a crafted byte stream containing the manipulated header fields. 3) The broker's protocol decoder reads the headers and calls the allocation logic. 4) The system attempts to reserve excessive memory, causing high memory pressure, potential heap fragmentation, or an OutOfMemoryError (OOM) that halts the execution of the broker instance.\nBecause this logic is invoked prior to authentication, the broker is unable to distinguish the malicious request from legitimate traffic, making the vulnerability particularly dangerous in network-exposed environments.\nThe lack of sanitization or a hard-coded cap on these allocation requests allows a single malicious request to trigger the resource exhaustion scenario, effectively denying service to all legitimate users of the broker. No specific privileges are required beyond the ability to establish a network connection to the service port, facilitating easy remote exploitation."
}