CVE-2026-92573

Description

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Traduire en français

Produits concernés

• Apache Software Foundation Apache Qpid Broker-J
• Apache qpid broker-j

Scores CVSS

Faiblesses (CWE)

• CWE-409

Références

• https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1y Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/09/24/15 Mailing ListThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories