CVE-2026-68080
Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service
- State
- Published
- Severity
- 6.5 Medium
- Published
- Aug 5, 2026
- Updated
- Aug 5, 2026
- Reserved
- Jul 30, 2026
Description
It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.
This issue affects Apache Qpid Broker-J: through 10.0.1.
Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
Affected Products
| Product | Versions |
|---|---|
Apache Qpid Broker-JApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.