CVE-2026-92573 Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message con

What is CVE-2026-92573?

CVE-2026-92573 is a medium-severity vulnerability in Apache Qpid Broker-J, published on 25 Sep 2026.

Official description

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.

This issue affects Apache Qpid Broker-J: through 10.1.0.

Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Weakness: CWE-409

Which versions are affected by CVE-2026-92573?

It affects 1 product.

Products include Apache Qpid Broker-J.

How do I fix CVE-2026-92573?

No fix has been published for CVE-2026-92573 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-92573 being exploited?

There is no known exploitation of CVE-2026-92573 in the wild and no public exploit code.

Other vulnerabilities in Apache Qpid Broker-J

• CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication Critical 9.8
• CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing Critical 9.8
• CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication Critical 9.1
• CVE-2026-92550 Denial of service in Apache Qpid Broker-J High 7.5
• CVE-2026-92560 Denial of service in Apache Qpid Broker-J High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wmmp-xjhm-fpp4.