Qpid Broker-j (Apache) - vulnerabilities (CVEs)

21 CVEs, 0 in the last 30 days, 56 known versions, newest CVE from 2026-09-25. Vendor: Apache.

CVEs of Qpid Broker-j

CVE-2026-92550 - CVSS 7.5 (high), 2026-09-25: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
CVE-2026-92560 - CVSS 7.5 (high), 2026-09-25: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
CVE-2026-92573 - CVSS 6.5 (medium), 2026-09-25: Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP…
CVE-2026-92564 - CVSS 7.5 (high), 2026-09-25: A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache…
CVE-2026-92608 - CVSS 7.5 (high), 2026-09-25: Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to…
CVE-2026-92609 - CVSS 9.8 (critical), 2026-09-25: Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a…
CVE-2026-68080 - CVSS 6.5 (medium), 2026-08-05: It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage…
CVE-2026-68078 - CVSS 6.5 (medium), 2026-08-05: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource…
CVE-2026-68077 - CVSS 6.5 (medium), 2026-08-05: An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to…
CVE-2026-68075 - CVSS 6.5 (medium), 2026-08-05: An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid…
CVE-2026-68073 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache…
CVE-2026-68060 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
CVE-2026-68074 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects…
CVE-2019-0200 - CVSS 7.5 (high), 2019-03-06: A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to…
CVE-2018-8030 - CVSS 7.5 (high), 2018-06-20: A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages…
CVE-2018-1298 - CVSS 5.9 (medium), 2018-02-09: A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91…
CVE-2017-15701 - CVSS 7.5 (high), 2017-12-01: In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote…
CVE-2017-15702 - CVSS 9.8 (critical), 2017-12-01: In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP…
CVE-2016-8741 - CVSS 7.5 (high), 2017-05-15: The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the…
CVE-2016-4432 - CVSS 9.1 (critical), 2016-06-01: The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently…
CVE-2016-3094 - CVSS 5.9 (medium), 2016-06-01: PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial…