CVE-2026-92573
Medium
Description
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Apache Qpid Broker-j
PublishedSep 25, 2026
First seenSep 25, 2026
Weakness typeCWE-409CWE-409
How to fix
Update
- apache qpid_broker-j10.1.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache qpid_broker-j | v < 10.1.1 | 10.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.