Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.qpid:apache-qpid-broker-j | >= 7.0.0, < 7.0.1 | 7.0.1 |
References
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-20- Platform
- Java / Kotlin (Maven)
- Package
org.apache.qpid:apache-qpid-broker-j- Disclosed
- 19.10.2018
- Updated
- 11.10.2026 11:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6w3v-66mj-2qm6 - CC BY 4.0
Vulnerability history: org.apache.qpid:apache-qpid-broker-j
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 10.2018 03.2019
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
Disclosures per year
- 2018: 2
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.