CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly.
This issue affects Apache Qpid Broker-J: through 10.1.0.
Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Broker-Jto a version that resolves this vulnerability.Fixed in 10.1.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated message producer and be able to send AMQP 1.0 messages with properties that the AMQP 0-10 target encoder does not handle correctly.
Which consumers are exposed to the delivery disruption?
The impact is on AMQP 0-10 consumers receiving messages converted from AMQP 1.0. The issue can disrupt delivery to those consumers.
Which Broker-J versions need remediation?
Apache Qpid Broker-J versions through 10.1.0 are affected. Upgrade to version 10.1.1, which fixes the issue.