VulnerabilityAnalyzed

CVE-2026-68078

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

MEDIUM 6.5EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.41% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-770
Affected: apache/qpid broker-j
Source: security@apache.org

References

https://lists.apache.org/thread/m8gs6pfp1fmbgwcjr8zsgn95hfh15f8oMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/04/19Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.