95406 matches found
CVE-2026-92564 Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue...
EUVD-2026-86583
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue...
CVE-2026-92608
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...
CVE-2026-92608 Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...
CVE-2026-92608 Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...
EUVD-2026-86582
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...
org.apache.qpid:apache-qpid-broker-j (>=10.0.0, <=10.1.0), org.apache.qpid:qpid-broker (>=10.0.0, <=10.1.0) potentially affected by CVE-2026-92608 via org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0 (>=10.0.0, <=10.1.0)
org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0 MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.1.0 Source cves: CVE-2026-92608 Source advisory: MEND:CVE-2026-92608...
CVE-2026-92608
The Apache Qpid Broker-J software, versions through 10.1.0 , is vulnerable to a flaw involving improper handling of property-encoding exceptions during AMQP 1.0-to-AMQP 0-10 message conversion. This issue allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers by using m...
CVE-2026-92608 Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10
Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target encoder does not handle correctly. This issue affects Apache Qpid Broker-J: throug...
CVE-2026-92609
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
EUVD-2026-86581
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609
Apache Qpid Broker-J versions through 10.1.0 are vulnerable to a session fixation flaw in the HTTP management authentication. The root cause is the missing renewal of HTTP sessions after a successful authentication, which allows a remote attacker to reuse a session identifier to gain unauthorized...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
org.apache.qpid:apache-qpid-broker-j (>=10.0.0, <=10.1.0), org.apache.qpid:qpid-broker (>=10.0.0, <=10.1.0) potentially affected by CVE-2026-92609 via org.apache.qpid:qpid-broker-plugins-management-http (>=10.0.0, <=10.1.0)
org.apache.qpid:qpid-broker-plugins-management-http MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.1.0 Source cves: CVE-2026-92609 Source advisory: MEND:CVE-2026-92609...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
Path Traversal
Apache Ant is vulnerable to a path traversal. The vulnerability is due to insufficient validation of relative paths provided by a remote server, which allows an attacker controlling or intercepting the server connection to write files outside the intended download directory and overwrite arbitrar...
Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...
OESA-2026-4048 activemq security update
The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...
OESA-2026-4049 activemq security update
The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof clientId when removing a durable...