Apache Qpid Broker J
Monthly
Denial of service in Apache Qpid Broker-J through 10.0.1 allows authenticated session participants to exhaust broker resources by deliberately exceeding the AMQP session flow control incoming window. The broker fails to enforce adequate limits on resource allocation when a session window is overflowed, enabling a malicious but authenticated client to destabilize or crash the broker. No public exploit code exists at time of analysis, and no confirmed active exploitation has been reported.
Unauthenticated remote denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting uncontrolled recursion during type-nesting processing, which exhausts the JVM call stack and triggers a StackOverflowError. The attack requires no credentials and no user interaction against any reachable broker instance. No public exploit identified at time of analysis; EPSS of 0.19% (9th percentile) indicates low real-world exploitation probability. Vendor-released patch: 10.1.0.
Unauthenticated denial-of-service in Apache Qpid Broker-J through 10.0.1 allows any network-reachable attacker to crash or hang the broker by sending crafted AMQP protocol messages that exploit improper type size/count validation, triggering unbounded memory allocation. The flaw resides in the pre-authentication protocol parsing path, requiring no credentials, user interaction, or special configuration. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.19% (9th percentile) indicates minimal observed exploitation activity despite the straightforward attack vector.
Remote unauthenticated denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting unbounded symbol value caching in the AMQP message processing layer. A pre-authentication attacker can exhaust broker resources without supplying any credentials, crashing or hanging the service. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.21% (11th percentile) indicates low exploitation probability at time of analysis, though the network-accessible, zero-complexity attack path keeps it a meaningful patching priority for exposed deployments.
Denial of service in Apache Qpid Broker-J through 10.0.1 allows authenticated session participants to exhaust broker resources by deliberately exceeding the AMQP session flow control incoming window. The broker fails to enforce adequate limits on resource allocation when a session window is overflowed, enabling a malicious but authenticated client to destabilize or crash the broker. No public exploit code exists at time of analysis, and no confirmed active exploitation has been reported.
Unauthenticated remote denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting uncontrolled recursion during type-nesting processing, which exhausts the JVM call stack and triggers a StackOverflowError. The attack requires no credentials and no user interaction against any reachable broker instance. No public exploit identified at time of analysis; EPSS of 0.19% (9th percentile) indicates low real-world exploitation probability. Vendor-released patch: 10.1.0.
Unauthenticated denial-of-service in Apache Qpid Broker-J through 10.0.1 allows any network-reachable attacker to crash or hang the broker by sending crafted AMQP protocol messages that exploit improper type size/count validation, triggering unbounded memory allocation. The flaw resides in the pre-authentication protocol parsing path, requiring no credentials, user interaction, or special configuration. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.19% (9th percentile) indicates minimal observed exploitation activity despite the straightforward attack vector.
Remote unauthenticated denial of service in Apache Qpid Broker-J (all versions through 10.0.1) is achievable by exploiting unbounded symbol value caching in the AMQP message processing layer. A pre-authentication attacker can exhaust broker resources without supplying any credentials, crashing or hanging the service. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.21% (11th percentile) indicates low exploitation probability at time of analysis, though the network-accessible, zero-complexity attack path keeps it a meaningful patching priority for exposed deployments.