EUVD-2026-53094
GHSA-4ghv-c34h-v2jx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable AMQP endpoint requires authenticated access (PR:L); no conditions beyond credentials; sole impact is high availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Resource exhaustion in Apache Qpid Broker-J through version 10.0.1 enables authenticated remote attackers to cause denial of service by submitting an unbounded number of AMQP 1.0 transfer frames within a single incoming delivery, with no broker-side enforcement of a per-delivery frame ceiling. The broker's AMQP 1.0 protocol plugin lacks the necessary throttling logic, meaning sustained abuse can exhaust memory and CPU resources and deny service to legitimate messaging clients. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 10.1.0.
Technical ContextAI
Apache Qpid Broker-J is a pure-Java AMQP message broker; the vulnerability resides specifically in the Maven artifact org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol, the plugin responsible for handling AMQP 1.0 sessions and link flows. In AMQP 1.0, large message deliveries are legitimately segmented into multiple transfer frames across a session; the protocol specification permits this fragmentation but does not mandate a maximum fragment count. The affected code path failed to impose any upper bound on the number of transfer frames accepted per delivery, making it subject to uncontrolled resource consumption - a root cause consistent with CWE-770 (Allocation of Resources Without Limits or Throttling). No CWE or CPE strings were supplied in the input data, so this classification is inferred from the description. No CVSS vector was provided by the reporting source.
RemediationAI
Upgrade Apache Qpid Broker-J to version 10.1.0, which the vendor confirms resolves this issue; see the advisory at https://qpid.apache.org/. If an immediate upgrade is not feasible, restrict AMQP 1.0 broker access at the network perimeter to only explicitly trusted client IP ranges, reducing the pool of accounts that could abuse the flaw - note this does not eliminate the vulnerability but limits the attack surface to already-credentialed parties. Additionally, applying broker-level connection and session quotas (where supported by the broker configuration) and monitoring for anomalously large or long-lived deliveries can help detect and throttle abusive behavior. These compensating controls introduce operational overhead and do not substitute for patching.
More in Qpid Broker J
View allIn Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on differ
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to b
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame si
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which all
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 clie
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allow
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connect
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today