CVE-2026-68073 is a high severity (CVSS 7.5) denial of service flaw in Apache Qpid Broker-J. A pre-authentication attacker can use type nesting to cause a StackOverflowError. Versions through 10.0.1 are affected. Upgrade to Apache Qpid Broker-J 10.1.0, which fixes the issue.
What's affected
The record says Apache Qpid Broker-J through 10.0.1 is affected and recommends upgrading to 10.1.0. That text comes from the Apache announcement. I could not retrieve the announcement thread itself (the mailing list archive page needs scripting to render), so the version facts here come from the record.
The attacker needs no credentials. The record says a pre-authentication attacker can trigger the failure, which means anyone who can reach the broker's messaging port can try it.
The record gives no workaround. Check the Apache announcement and the Qpid security page for any additional guidance before you decide your rollout plan.
How to check if you're exposed
Find your broker version. The broker prints its version at startup, and the management console shows it. From the host, check the install directory name or the startup log:
grep -i "qpid" /path/to/work/qpid-broker.log | head
ls /opt | grep -i qpid
Adjust paths to your layout. For container deployments, check the image tag. Then note which networks can reach the AMQP ports. An internal only broker is a lower risk than one open to the internet, but the record says no authentication is needed, so any host that can connect matters.
A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.
What to do now
- Upgrade Apache Qpid Broker-J to 10.1.0 or later.
- Limit network access to AMQP ports to the clients that need them, using firewall rules or security groups.
- Monitor broker restarts and error logs for repeated stack overflow errors, which could indicate probing.
- Run the broker under a supervisor that restarts it, and set alerts on restart frequency.
- Check the Apache announcement and the Qpid security page for guidance beyond the record.
Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.
Why it matters
The class is CWE-674, uncontrolled recursion. A parser that handles nested data types calls itself for each level. If nothing limits the depth, a message with enough nesting uses up the call stack, and the Java virtual machine throws a StackOverflowError.
Because this happens before authentication, the usual defence of strong credentials does not help. The fix for this class is a depth limit enforced at the parser. The record does not mark this CVE as known exploited.
Quick check
Do I need an account on the broker to trigger it?
No. The record calls the attacker pre-authentication.
Which version fixes it?
10.1.0, per the record, which says users are recommended to upgrade to it.
Sources
- https://lists.apache.org/thread/djz1gnrk882vzjo8rykyf9bnywqbvwwr (listed in the record, not retrieved for this review)
- Record: NVD entry for CVE-2026-68073 (score 7.5, HIGH)
Last reviewed: 18 October 2026.
