CVE-2026-68073 is a pre-authentication StackOverflowError in Qpid Broker-J's AMQP parsing layer, affecting versions 10.0.1 and earlier. The vulnerability triggers when deeply nested type structures are sent to the broker before any authentication occurs — the recursive deserialization hits the JVM stack limit and crashes the handling thread.
This is a critical architectural failure, not just a code defect. The parsing code that processes incoming AMQP messages runs before identity verification, which means the attack surface is every socket that can reach the broker port — not just authenticated clients. In a multi-tenant message broker, that's the entire exposed surface, not a narrow slice. A single malformed message can exhaust a thread's stack, and under load this can cascade into broker-wide instability affecting consumers who never sent malicious input.
The root cause is a dangerous assumption in how the parsing layer was designed: 'valid AMQP message' was treated as semantically equivalent to 'safe input.' That's the vulnerability. The parsing code operated under an implicit assumption of trust that was never justified at the network boundary.
To defend against this: First, verify your Qpid Broker-J version — anything below 10.1.0 is vulnerable. Second, treat this as a pre-authentication vulnerability regardless of your authentication configuration — network-facing parsing is the attack vector, not a compromised credential. Third, examine whether your broker's architectural model places message parsing entirely before authentication checks; if it does, consider whether network-level filtering or a protective broker in front can validate message structure before it reaches the parsing layer. Fourth, monitor thread pool health and stack usage on your broker — StackOverflowError from malformed input is the exploitation signature. Finally, check whether other message types or AMQP protocol handlers in your broker have similar recursive parsing patterns that weren't addressed by this patch — the fix may be specific to this nesting vector while leaving structurally similar code paths intact elsewhere.