GHSA-4r7g-7cpj-5jr7HighCVSS 7.5

Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption

Published
October 19, 2018
Last Modified
November 4, 2023

🔗 CVE IDs covered (1)

CVE-2017-15701 →

📋 Description

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.

🎯 Affected products1

  • maven/org.apache.qpid:qpid-broker:>= 6.1.0, < 6.1.5

🔗 References (6)