CVE-2026-68073 - Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow

HIGH

Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow

Published Aug 5, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.77%

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Vendor Apache Software Foundation Product Apache Qpid Broker-J Default
unaffected
Affected
- ≥ 0, ≤ 10.0.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apache Software Foundation	Apache Qpid Broker-J	unaffected	Affected ≥ 0, ≤ 10.0.1

No remediation recorded yet.

Weaknesses (1)

CWE-674

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/08/04/15		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53083		Advisory
https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr		vendor-advisoryMailing ListVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Aug 5, 2026

Updated Aug 6, 2026

Reserved Jul 30, 2026

CISA Vulnrichment

Updated Aug 6, 2026

NVD

Status Modified

Modified Aug 6, 2026

Red Hat

No data

ENISA EUVD

Assigner apache

Published Aug 5, 2026

Updated Aug 6, 2026

GitHub

No data