Qpid Broker J
Monthly
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated attackers hijack an administrator's authenticated management session by reusing a session identifier that is retained across successful authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the broker's management functions. Exploitation requires the HTTP management interface to be reachable by the attacker and, critically, requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login, so the assessed vector is AV:N/AC:H/PR:N/UI:R rather than the NVD-published 9.8 CRITICAL (AC:L/UI:N), which is inconsistent with the session-fixation class. There is no public exploit identified at time of analysis, and brokers are only exposed where management access is not otherwise restricted; upgrading to 10.1.1 addresses the flaw.
Denial of service in Apache Qpid Broker-J through 10.1.0 allows an authenticated AMQP 1.0 message producer to disrupt message delivery to AMQP 0-10 consumers by publishing messages carrying properties that the AMQP 1.0-to-0-10 conversion encoder cannot encode. The impact is limited to brokers actually bridging the two protocol generations - an AMQP 1.0 producer path feeding AMQP 0-10 consumers must be in use for the flaw to be reachable - and no public exploit code or confirmed active exploitation has been identified at time of analysis. EPSS is 0.16% (4th percentile), consistent with a genuine but moderate availability issue; the vendor has released Qpid Broker-J 10.1.1 as the fix.
Unauthenticated remote denial of service in Apache Qpid Broker-J through 10.1.0, where a crafted AMQP 0-8/0-9/0-9-1 field table with deeply nested types drives unbounded recursion in the broker's parser and triggers a StackOverflowError that can crash the broker. The flaw is reachable pre-authentication over the network with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, High), affecting any broker exposing the legacy AMQP 0-8/0-9/0-9-1 protocol plugin, including its default configuration. No public exploit code or confirmed active exploitation was identified at time of analysis; impact is limited to availability, with no data disclosure, integrity loss, or code execution.
Pre-authentication denial of service in Apache Qpid Broker-J through 10.1.0: a remote attacker who can reach a broker with the AMQP 0-10 protocol plugin enabled can send frames whose type size and count fields are not properly bounded, driving the decoder into excessive memory allocation and potentially exhausting broker resources. The affected code path is reached before authentication (assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so no credentials or user interaction are required; impact is limited to availability, with no confidentiality or integrity effect. There is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); a vendor-released fix exists in version 10.1.1.
Pre-authentication denial of service in Apache Qpid Broker-J (through 10.1.0) allows a remote attacker to exhaust broker memory or crash it by sending a malformed AMQP 0-8/0-9/0-9-1 frame whose type size/count fields drive an oversized allocation; the decoder handles this frame before authentication is performed, so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no data disclosure or code execution). Exploitation only requires network reachability to an enabled legacy AMQP 0-8/0-9/0-9-1 listener, so deployments that exclusively use AMQP 1.0 are not on the affected code path, and firewalling the AMQP port to trusted clients removes exposure. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Memory exhaustion in Apache Qpid Broker-J through 10.1.0 allows authenticated message producers to degrade or disrupt broker availability by submitting compressed AMQP payloads that the shared GZIP decompressor processes without a decompressed-output cap, affecting message delivery, message conversion, and HTTP management JSON rendering. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, confirming a network-reachable, low-privileged availability-only condition rather than code execution or data compromise. No public exploit code, CISA KEV entry, or EPSS score is available at time of analysis, so active exploitation is not indicated; users should upgrade to Qpid Broker-J 10.1.1.
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
Resource exhaustion in Apache Qpid Broker-J through version 10.0.1 enables authenticated remote attackers to cause denial of service by submitting an unbounded number of AMQP 1.0 transfer frames within a single incoming delivery, with no broker-side enforcement of a per-delivery frame ceiling. The broker's AMQP 1.0 protocol plugin lacks the necessary throttling logic, meaning sustained abuse can exhaust memory and CPU resources and deny service to legitimate messaging clients. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 10.1.0.
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker CPU resources by sending crafted disposition frames containing large or illegal delivery-ID ranges. The broker's naive range iteration logic processes these ranges without bounds enforcement, causing excessive CPU consumption that degrades or halts message brokering for all connected clients. No public exploit code and no confirmed active exploitation are known at time of analysis; vendor-released fix 10.1.0 is available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
Session fixation in the HTTP management interface of Apache Qpid Broker-J through 10.1.0 lets remote, unauthenticated attackers hijack an administrator's authenticated management session by reusing a session identifier that is retained across successful authentication, yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the broker's management functions. Exploitation requires the HTTP management interface to be reachable by the attacker and, critically, requires a legitimate management user - typically an administrator - to authenticate using a session identifier the attacker has planted, fixed, or otherwise obtained before login, so the assessed vector is AV:N/AC:H/PR:N/UI:R rather than the NVD-published 9.8 CRITICAL (AC:L/UI:N), which is inconsistent with the session-fixation class. There is no public exploit identified at time of analysis, and brokers are only exposed where management access is not otherwise restricted; upgrading to 10.1.1 addresses the flaw.
Denial of service in Apache Qpid Broker-J through 10.1.0 allows an authenticated AMQP 1.0 message producer to disrupt message delivery to AMQP 0-10 consumers by publishing messages carrying properties that the AMQP 1.0-to-0-10 conversion encoder cannot encode. The impact is limited to brokers actually bridging the two protocol generations - an AMQP 1.0 producer path feeding AMQP 0-10 consumers must be in use for the flaw to be reachable - and no public exploit code or confirmed active exploitation has been identified at time of analysis. EPSS is 0.16% (4th percentile), consistent with a genuine but moderate availability issue; the vendor has released Qpid Broker-J 10.1.1 as the fix.
Unauthenticated remote denial of service in Apache Qpid Broker-J through 10.1.0, where a crafted AMQP 0-8/0-9/0-9-1 field table with deeply nested types drives unbounded recursion in the broker's parser and triggers a StackOverflowError that can crash the broker. The flaw is reachable pre-authentication over the network with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, High), affecting any broker exposing the legacy AMQP 0-8/0-9/0-9-1 protocol plugin, including its default configuration. No public exploit code or confirmed active exploitation was identified at time of analysis; impact is limited to availability, with no data disclosure, integrity loss, or code execution.
Pre-authentication denial of service in Apache Qpid Broker-J through 10.1.0: a remote attacker who can reach a broker with the AMQP 0-10 protocol plugin enabled can send frames whose type size and count fields are not properly bounded, driving the decoder into excessive memory allocation and potentially exhausting broker resources. The affected code path is reached before authentication (assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so no credentials or user interaction are required; impact is limited to availability, with no confidentiality or integrity effect. There is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV); a vendor-released fix exists in version 10.1.1.
Pre-authentication denial of service in Apache Qpid Broker-J (through 10.1.0) allows a remote attacker to exhaust broker memory or crash it by sending a malformed AMQP 0-8/0-9/0-9-1 frame whose type size/count fields drive an oversized allocation; the decoder handles this frame before authentication is performed, so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact, no data disclosure or code execution). Exploitation only requires network reachability to an enabled legacy AMQP 0-8/0-9/0-9-1 listener, so deployments that exclusively use AMQP 1.0 are not on the affected code path, and firewalling the AMQP port to trusted clients removes exposure. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Memory exhaustion in Apache Qpid Broker-J through 10.1.0 allows authenticated message producers to degrade or disrupt broker availability by submitting compressed AMQP payloads that the shared GZIP decompressor processes without a decompressed-output cap, affecting message delivery, message conversion, and HTTP management JSON rendering. The assessed CVSS:3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, confirming a network-reachable, low-privileged availability-only condition rather than code execution or data compromise. No public exploit code, CISA KEV entry, or EPSS score is available at time of analysis, so active exploitation is not indicated; users should upgrade to Qpid Broker-J 10.1.1.
Unbounded echo flow responses in Apache Qpid Broker-J (all versions through 10.0.1) allow an authenticated AMQP 1.0 client to exhaust broker resources and cause denial of service by flooding the broker with unanswered echo flow frames. The root cause is absent rate-limiting on echo flow response logic in the qpid-broker-plugins-amqp-1-0-protocol plugin. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 10.1.0.
Resource exhaustion in Apache Qpid Broker-J through version 10.0.1 enables authenticated remote attackers to cause denial of service by submitting an unbounded number of AMQP 1.0 transfer frames within a single incoming delivery, with no broker-side enforcement of a per-delivery frame ceiling. The broker's AMQP 1.0 protocol plugin lacks the necessary throttling logic, meaning sustained abuse can exhaust memory and CPU resources and deny service to legitimate messaging clients. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 10.1.0.
Denial of service in Apache Qpid Broker-J through version 10.0.1 allows authenticated AMQP 1.0 clients to exhaust broker CPU resources by sending crafted disposition frames containing large or illegal delivery-ID ranges. The broker's naive range iteration logic processes these ranges without bounds enforcement, causing excessive CPU consumption that degrades or halts message brokering for all connected clients. No public exploit code and no confirmed active exploitation are known at time of analysis; vendor-released fix 10.1.0 is available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.