CVE-2026-68074

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-680756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affectCVE-2026-680765.4Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard mCVE-2026-680776.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handlingCVE-2026-680786.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excesCVE-2026-680799.8In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw CVE-2026-68086.1The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up tCVE-2026-680806.5It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessCVE-2026-68081In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid gueCVE-2026-680829.8In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockerCVE-2026-680839.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 openCVE-2026-68084In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi148 bridge tsi148_pCVE-2026-680858.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
CVE-2026-68074: High severity, CVSS 7.5 | Vulnix