EUVD-2026-53099
GHSA-3jgf-c787-2jmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain valid AMQP credentials
-
DeliveryConnect to broker on AMQP 1.0
-
ExploitOpen session and links
-
InstallSend high-rate echo flow frames
-
C2Trigger unbounded broker responses
-
ExecuteExhaust CPU or thread pool
-
ImpactDeny service to legitimate clients
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Authentication is required - the attacker must possess valid AMQP credentials to establish a session with the broker. The AMQP 1.0 protocol plugin (qpid-broker-plugins-amqp-1-0-protocol) must be active, which is the standard deployment configuration for Broker-J. No special broker configuration beyond accepting AMQP 1.0 connections is needed to be vulnerable. Limiting factors: valid credentials are required (rules out fully external, unauthenticated attackers); impact is restricted to availability only (no data exposure); exploitation requires sustained high-rate flow frame transmission, making it detectable via traffic volume monitoring. |
| Impact | The vendor rates this 'important', but no official CVSS vector, EPSS score, or KEV listing is present in the available data. Inferred CVSS signals suggest a network-accessible, low-complexity attack requiring authentication, with high availability impact and no confidentiality or integrity loss - yielding a moderate-to-high base score in the 6.5-7.5 range. The authentication prerequisite is the primary mitigating factor: only clients that have already established a valid AMQP session can trigger the flaw, limiting exposure to trusted users, service accounts, or compromised credentials. Impact is purely availability (DoS), not data exfiltration or code execution. No EPSS data is available, and the absence of KEV listing and known POC suggests exploitation has not been observed at scale. The practical priority is elevated for organizations operating Qpid Broker-J in multi-tenant or Internet-accessible configurations, where attacker access to AMQP credentials is more plausible. |
| Exploit ScenarioDerived | An attacker with valid AMQP credentials connects to a Broker-J instance running version 10.0.1 or earlier and opens one or more AMQP 1.0 sessions. The attacker then repeatedly sends flow frames with the echo flag set at high frequency, causing the broker to generate a corresponding response for each request without any throttle. This saturates the broker's CPU or thread pool, degrading or halting message delivery for all legitimate producers and consumers connected to the broker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 04, 2026
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
RemediationAI
Upgrade Apache Qpid Broker-J to version 10.1.0, which introduces rate governance on echo flow responses and fully resolves the issue. This is the vendor-confirmed fix version as stated in the oss-security advisory. Prior to patching, operators should restrict AMQP 1.0 access to explicitly trusted and authenticated clients by enforcing strict credential management and network-level access controls (e.g., firewall rules limiting AMQP port 5672/5671 to known client IP ranges); note that this reduces exposure but does not eliminate it if internal accounts are compromised. Disabling the AMQP 1.0 protocol plugin entirely is a more aggressive workaround if that protocol version is not operationally required, though it will break AMQP 1.0 client connectivity. Monitor broker resource utilization (CPU, heap, thread pool) for anomalous spikes as an interim detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Qpid Broker-J is a pure-Java AMQP message broker maintained by the Apache Software Foundation. The affected component is the AMQP 1.0 protocol plugin, identified by Maven artifact org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol. In AMQP 1.0, 'flow' performatives are used to manage link credit and flow control between peers; a sender may set the 'echo' flag to request that the receiver send a flow frame in reply. The broker failed to impose any rate limit or ceiling on how frequently it would service such echo requests, creating an uncontrolled resource consumption path. No CWE is formally assigned, but this behavior maps to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). The issue is confined to the AMQP 1.0 plugin and does not appear to affect other Qpid protocol stacks.
Know when Qpid Broker J gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable broker requires an authenticated AMQP session (PR:L, AV:N); only availability is impacted by resource exhaustion with no scope change.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
Apache Qpid Broker-J through version 10.0.1 contains a critical denial-of-service vulnerability that allows authenticated users to crash message brokers, disrupting enterprise messaging infrastructure. Organizations relying on Qpid for application communication face service outages affecting multiple dependent systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Qpid Broker J
View allIn Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on differ
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated at
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to b
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame si
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth
Unauthenticated remote denial of service in Apache Qpid Broker-J through 10.1.0, where a crafted AMQP 0-8/0-9/0-9-1 fiel
Pre-authentication denial of service in Apache Qpid Broker-J through 10.1.0: a remote attacker who can reach a broker wi
Pre-authentication denial of service in Apache Qpid Broker-J (through 10.1.0) allows a remote attacker to exhaust broker
Denial of service in Apache Qpid Broker-J through 10.1.0 allows an authenticated AMQP 1.0 message producer to disrupt me
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which all
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker
Exploit-DB