# org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol (Maven) vulnerabilities 8 known vulnerabilities (3 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.1.1 (Sep 20, 2026): no advisory affects it - Newest unaffected release: 10.1.1 (Sep 20, 2026), the latest release - Dependents: 6 - Releases: 60 since 0.24 (Sep 1, 2013) - Registry: https://central.sonatype.com/artifact/org.apache.qpid/qpid-broker-plugins-amqp-1-0-protocol - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-68080: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68078: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68077: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68075: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68073: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68060: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2026-68074: 0.24 to 10.0.1 (10.1.0 is outside it) - CVE-2016-4432: 0.24 to 6.0.2 (6.0.3 is outside it) ## Advisories (8) ### [CVE-2026-68080](https://cve.now/CVE-2026-68080): Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service - Severity: Medium 6.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68078](https://cve.now/CVE-2026-68078): Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery - Severity: Medium 6.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68077](https://cve.now/CVE-2026-68077): Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service - Severity: Medium 6.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68075](https://cve.now/CVE-2026-68075): Apache Qpid Broker-J: Incoming session flow control window can be exceeded - Severity: Medium 6.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68073](https://cve.now/CVE-2026-68073): Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68060](https://cve.now/CVE-2026-68060): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2026-68074](https://cve.now/CVE-2026-68074): Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: through 10.0.1. - Fixed in 10.1.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.1.1, is not affected. ### [CVE-2016-4432](https://cve.now/CVE-2016-4432): The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass… - Severity: Unrated - Published: Jun 1, 2016 - Affected: fixed in 6.0.3. - Fixed in 6.0.3 (released May 19, 2016, 13 days before disclosure). - The latest release, 10.1.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.