- Latest release
- 10.1.1 (Sep 20, 2026): no advisory affects it
- Newest unaffected release
- 10.1.1 (Sep 20, 2026), the latest release
- Advisories
- 8 · 3 high, 4 medium
- Dependents
- 6
- Releases
- 60 since 0.24 (Sep 1, 2013)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-68080Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68078Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68077Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68075Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68073Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68060Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2026-68074Affects 0.24 to 10.0.1 (10.1.0 is outside it)
- CVE-2016-4432Affects 0.24 to 6.0.2 (6.0.3 is outside it)
Advisories 8
- CVE-2026-68080Medium 6.5
Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68078Medium 6.5
Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68077Medium 6.5
Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68075Medium 6.5
Apache Qpid Broker-J: Incoming session flow control window can be exceeded
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68073High 7.5
Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68060High 7.5
Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2026-68074High 7.5
Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
Affected: through 10.0.1.
Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 10.1.1, is not affected.
- CVE-2016-4432Unrated
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass…
Affected: fixed in 6.0.3.
Fixed in 6.0.3 (released May 19, 2016, 13 days before disclosure).
The latest release, 10.1.1, is not affected.