Apache Qpid Broker-J 10.0.1 Echo Flow Rate Limit DoS
CVE-2026-68080 Published on August 5, 2026

Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service
It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-68080 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is a Network Amplification Vulnerability?

The software does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. In the absence of a policy to restrict asymmetric resource consumption, the application or system cannot distinguish between legitimate transmissions and traffic intended to serve as an amplifying attack on target systems. Systems can often be configured to restrict the amount of traffic sent out on behalf of a client, based on the client's origin or access level. This is usually defined in a resource allocation policy. In the absence of a mechanism to keep track of transmissions, the system or application can be easily abused to transmit asymmetrically greater traffic than the request or client should be permitted to.

CVE-2026-68080 has been classified to as a Network Amplification vulnerability or weakness.


Products Associated with CVE-2026-68080

Want to know whenever a new CVE is published for Apache Qpid Broker J? stack.watch will email you.

Apache Qpid Broker J
 

Affected Versions

Apache Software Foundation Apache Qpid Broker-J: