A high-performance, lightweight AMQP 1.0 message router, written in C and built on Qpid Proton. It provides flexible and scalable interconnect between any AMQP endpoints, whether they be clients, brokers or other AMQP-enabled services.
Apache Qpid Dispatch suffers from a denial-of-service vulnerability caused by unbounded recursion in its AMQP field parser. The parser recurses once per nested child with no depth limit when parsing message annotations, so a remote peer can send a deeply nested AMQP message and exhaust the stack, crashing the router. This issue is tracked as CVE-2026-88763 assigned by Red Hat as the CNA against the maintained downstream component skupper-router (Red Hat Service Interconnect), which carries the same AMQP field parser. The Apache Qpid Dispatch project is frozen (development moved to skupper-router). Red Hat notes that exploitation requires a valid x.509 certificate signed by the interconnect certificate authority, i.e. a peer already admitted to the mutually authenticated network, can crash the router.