CVE-2026-92564 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Qpid Broker-J deployments should assess exposure and prioritize upgrading to version 10.1.1. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure and implement mitigations. The vulnerability has a potential denial of service impact through StackOverflowError, emphasizing the need for prompt verification and mitigation.

Why it matters

Defenders should prioritize verifying exposure and upgrading to version 10.1.1 to prevent potential denial of service attacks.

• Potential denial of service through StackOverflowError.

Technical summary

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError in Apache Qpid Broker-J through version 10.1.0, potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue. The vulnerability has a potential denial of service impact through StackOverflowError, emphasizing the need for prompt verification and mitigation. Defenders should assess exposure and prioritize upgrading to version 10.1.1.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 10.1.1.

Recommended defensive actions

• Verify if Apache Qpid Broker-J versions before 10.1.1 are in use.
• Upgrade to version 10.1.1 if vulnerable.
• Monitor for potential denial of service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry indicate a potential denial of service vulnerability in Apache Qpid Broker-J through version 10.1.0. The issue allows a pre-authentication attacker to leverage type nesting to cause a StackOverflowError. Evidence is limited to CVE and NVD entries; further verification is recommended. Defenders should verify exposure and consider upgrading to version 10.1.1. The CVE record was published on 2026-09-25T09:17:06.717Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.