Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-92560

Apache Qpid Broker-j: denial of service

Risk score
58/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.5%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.
Affected
Apache Qpid Broker-j before 10.1.1
Fix
Upgrade Apache Qpid Broker-j to 10.1.1 or later.
Exploitation
No known exploitation

Story map

Story map: Apache Qpid Broker-jTHE FLAWSTHE FIXCVE-2026-92560Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-92609Session fixation in HTTPmanagement authenticationallows remote attackers to…CVSS 9.8 · EPSS 0%CVE-2026-92550Denial of serviceCVSS 7.5 · EPSS 0%CVE-2026-92564Denial of serviceCVSS 7.5 · EPSS 0%Upgrade Apache Qpid…10.1.1or later on your release lineWho is exposedApache Qpid Broker-j before10.1.1AMBER · PATCH THIS WEEKApache QpidBroker-jSession fixation in HTTPmanagement authenticationallows remote attackers to gainunauthorized access to anauthenticated managementsession via reuse of a sessionidentifier retained across…Where it standsNo known exploitationCONNECTS TOSame weaknessDenial of service (CWE-770)202 other warnings in 30 days →Same productEarlier Apache Qpid Broker-j warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Qpid Broker-j: Amber, patch this week. Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version…

The flaws

  • CVE-2026-92560: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-92609: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-92550: Denial of service (CVSS 7.5 · EPSS 0%)
  • CVE-2026-92564: Denial of service (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Apache Qpid Broker-j: 10.1.1 or later on your release line

Who is exposed: Apache Qpid Broker-j before 10.1.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Last activity 25 Sep 2026. Patch Forecast updates every hour.