Description

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-25T09:17:06.837Z",
  "pubdate": "2026-09-25T09:17:06.837Z",
  "executiveSummary": "Apache Qpid Broker-J is susceptible to an uncontrolled resource consumption vulnerability stemming from the improper handling of compressed data within its shared GZIP decompressor.\nThe vulnerability allows an authenticated message producer to trigger significant memory exhaustion by sending maliciously crafted compressed payloads.\nThis flaw affects AMQP 0-8, 0-9, 0-9-1, and 0-10 message delivery paths, as well as message conversion processes and HTTP management JSON rendering.\nThe lack of an enforced limit on decompressed output size permits an attacker to perform a Denial of Service (DoS) attack, compromising broker availability.\nExploitation requires authenticated access to the message broker, making it a critical risk for environments where untrusted users can submit messages.\nThe vulnerability is resolved in Apache Qpid Broker-J version 10.1.1.",
  "technicalDetails": "The root cause of this vulnerability lies in the absence of a decompressed-output size constraint within the shared GZIP decompressor implementation used across Apache Qpid Broker-J.\nWhen the broker processes compressed messages or renders JSON via the HTTP management interface, it utilizes a shared decompression utility that fails to validate the expansion ratio of the input data.\nAn authenticated attacker can leverage this by sending a 'zip bomb' or highly compressed payload that expands into a disproportionately large memory allocation upon processing.\nThe attack flow begins when the broker receives an AMQP frame containing compressed data. During the decompression phase, the utility allocates heap memory to accommodate the resulting uncompressed byte stream. Because the utility does not verify the size of the output buffer against a predefined threshold, the expansion process consumes excessive system memory.\nThis behavior propagates through several critical paths: AMQP message delivery, where brokers must inspect or transform message content; message conversion, where data is transformed between versions; and HTTP management JSON rendering, where system state or message details are serialized for administrative interfaces.\nBy continuously submitting such payloads, an attacker can rapidly exhaust the JVM heap memory assigned to the broker, leading to frequent Garbage Collection (GC) pauses, subsequent OutOfMemoryError exceptions, and eventual service instability or crash.\nThe vulnerability is prevalent in versions up to and including 10.1.0. Because the resource exhaustion occurs during the expansion phase, the malicious payload does not need to be inherently large in its compressed state to inflict maximum damage on the target system’s memory availability.\nPost-exploitation impact is limited to a Denial of Service scenario; however, given the role of a message broker in an enterprise architecture, the degradation of service effectively halts all dependent downstream applications, representing a significant disruption to message queuing operations and data flow."
}