CVE-2026-68078CWE-770denial-of-service

CVE-2026-68078

Medium · published August 5, 2026

CVSS v3.1

6.5

EPSS

Percentile

50.6

In the wild

Unconfirmed

What it is

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00653 · 50.6th percentile
Weakness: CWE-770 · Allocation of Resources Without Limits or Throttling
Published: 2026-08-05T11:16Z

Affected products (1)

Product	Versions	Fixed in
apache/qpid_broker-j	< 10.1.0	10.1.0

References (2)

https://lists.apache.org/thread/m8gs6pfp1fmbgwcjr8zsgn95hfh15f8o · [email protected]http://www.openwall.com/lists/oss-security/2026/08/04/19 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

05 AUG 05:43Z
Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery
cvelistv5