CVE-2026-92573

MediumCVSS 6.5/10Last modified Oct 5, 2026

Description

Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit.

This issue affects Apache Qpid Broker-J: through 10.1.0.

Users are recommended to upgrade to version 10.1.1, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-409

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Qpid Broker-J	<= 10.1.0

References

https://lists.apache.org/thread/461lhqt1r4g1mq3oyrcscphxzlhxlv1yVendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/24/15Mailing List, Third Party Advisory

Timeline

Published: Sep 25, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-925748.8A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destina CVE-2026-925768.6HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() func CVE-2026-925777.5In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns CVE-2026-925788.1WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credent CVE-2026-925795.4In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, a CVE-2026-92589.8Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier CVE-2026-925808.8In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~2 CVE-2026-925814.3In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parame CVE-2026-925827.1AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVid CVE-2026-925836.5AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, all CVE-2026-925846.1AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endp CVE-2026-925854.3AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, a