CVE-2026-68077

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.

This issue affects Apache Qpid Broker-J: through 10.0.1.

Users are recommended to upgrade to version 10.1.0, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-606

Affected software

VendorProductVersions
Apache Software FoundationApache Qpid Broker-J<= 10.0.1

References

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-680786.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excesCVE-2026-680799.8In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw CVE-2026-68086.1The Pricing Tables for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up tCVE-2026-680806.5It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessCVE-2026-68081In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid gueCVE-2026-680829.8In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decode_lockers() decode_lockerCVE-2026-680839.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 openCVE-2026-68084In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi148 bridge tsi148_pCVE-2026-680858.0In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceledCVE-2026-68086In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is nCVE-2026-68087In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_CVE-2026-68088In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add v
CVE-2026-68077: Medium severity, CVSS 6.5 | Vulnix