CVE-2026-92560
Description
A flaw was found in Apache Qpid Broker-J within the Advanced Message Queuing Protocol (AMQP) 0-10 decoder component. An unauthenticated remote attacker could exploit improper type size and count handling by sending specially crafted network messages. This can trigger excessive memory allocation, resulting in a Denial of Service (DoS) due to resource exhaustion.
Statement
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger unbounded memory allocation, leading to process exhaustion and service termination without requiring authentication. In Red Hat environments such as Red Hat JBoss Fuse, the affected AMQP 0-10 protocol plugin is utilized within messaging broker integration components. Risk is primarily present in deployments where the broker listener is exposed directly to untrusted networks.
Mitigation
Restrict access to the AMQP broker service port (default TCP port 5672 or 5671) to trusted networks or localhost using firewall controls.
To limit access to authorized client subnets using firewalld:
1. Remove unrestricted public access to the AMQP port:
# firewall-cmd --zone=public --remove-port=5672/tcp --permanent
2. Allow access only from trusted source IP addresses or subnets:
# firewall-cmd --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> --permanent
3. Apply the firewall configuration:
# firewall-cmd --reload
Caveat: Blocking public broker port access will prevent any external or unlisted clients from connecting to the messaging service. Verify that all legitimate application endpoints and client networks are added to the trusted zone.
Warning: Reloading firewall rules may temporarily disrupt active network sessions or client connections.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
