CVE-2026-92550: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

Executive brief

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

This issue affects Apache Qpid Broker-J: through 10.1.0.

Users are recommended to upgrade to version 10.1.1, which fixes the issue.

References

• https://repo.maven.apache.org/maven2
• https://lists.apache.org/thread/56w1kxz9h23q364ffyvj7cssdhnld5dq