EUVD-2026-53099
GHSA-3jgf-c787-2jmh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable broker requires an authenticated AMQP session (PR:L, AV:N); only availability is impacted by resource exhaustion with no scope change.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
Technical ContextAI
Apache Qpid Broker-J is a pure-Java AMQP message broker maintained by the Apache Software Foundation. The affected component is the AMQP 1.0 protocol plugin, identified by Maven artifact org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol. In AMQP 1.0, 'flow' performatives are used to manage link credit and flow control between peers; a sender may set the 'echo' flag to request that the receiver send a flow frame in reply. The broker failed to impose any rate limit or ceiling on how frequently it would service such echo requests, creating an uncontrolled resource consumption path. No CWE is formally assigned, but this behavior maps to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). The issue is confined to the AMQP 1.0 plugin and does not appear to affect other Qpid protocol stacks.
RemediationAI
Upgrade Apache Qpid Broker-J to version 10.1.0, which introduces rate governance on echo flow responses and fully resolves the issue. This is the vendor-confirmed fix version as stated in the oss-security advisory. Prior to patching, operators should restrict AMQP 1.0 access to explicitly trusted and authenticated clients by enforcing strict credential management and network-level access controls (e.g., firewall rules limiting AMQP port 5672/5671 to known client IP ranges); note that this reduces exposure but does not eliminate it if internal accounts are compromised. Disabling the AMQP 1.0 protocol plugin entirely is a more aggressive workaround if that protocol version is not operationally required, though it will break AMQP 1.0 client connectivity. Monitor broker resource utilization (CPU, heap, thread pool) for anomalous spikes as an interim detection measure.
More in Qpid Broker J
View allIn Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on differ
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to b
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame si
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which all
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker
Resource exhaustion in Apache Qpid Broker-J through version 10.0.1 enables authenticated remote attackers to cause denia
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allow
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connect
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today