THE Apache Software Foundation has released Apache Qpid Broker-J 10.1.1 to address six vulnerabilities affecting versions through 10.1.0. The flaws span the AMQP 0-8, AMQP 0-10 and AMQP 1.0 protocol modules, as well as the HTTP management and core broker plugins. They comprise one critical, three high-severity, one medium and one unrated issue. CVE-2026-92609 is rated 9.8 (critical), while CVE-2026-92608, CVE-2026-92560 and CVE-2026-92550 each have a CVSSv3 score of 7.5. The report says none has been confirmed as exploited, and no public proof-of-concept code is available.
Several flaws could allow unauthenticated denial-of-service attacks during pre-authentication. Malformed AMQP messages with excessive size declarations or unbounded type nesting can trigger uncontrolled memory allocation or a stack overflow while being parsed. A separate decompression issue in the shared GZIP component could let authenticated producers exhaust broker memory by sending compressed messages without limits on decompressed output.
CVE-2026-92609 is a session-fixation flaw in the HTTP management interface: session identifiers are not renewed after login, potentially allowing an attacker to reuse a retained identifier for unauthorised access.
Administrators are advised to upgrade affected brokers to 10.1.1 using packages from the official Apache Qpid download page and consult Apache’s security advisories for further mitigation details.