CVE-2026-68060

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-680625.8SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can logCVE-2026-680679.8The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for tCVE-2026-680689.0The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-CVE-2026-68075.5A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintendedCVE-2026-680708.8The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytCVE-2026-680737.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issuCVE-2026-680747.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. ThisCVE-2026-680756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affectCVE-2026-680765.4Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard mCVE-2026-680776.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handlingCVE-2026-680786.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excesCVE-2026-680799.8In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw
CVE-2026-68060: High severity, CVSS 7.5 | Vulnix