Apache
Apache Qpid Broker-j: vulnerabilidades y CVE
Apache Qpid Broker-j tiene 20 vulnerabilidades publicadas, 12 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses12
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-92564 | Alta (7.5) | 0.37% | — | 25 sept 2026 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade… |
| CVE-2026-92560 | Alta (7.5) | 0.37% | — | 25 sept 2026 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended… |
| CVE-2026-92550 | Alta (7.5) | 0.37% | — | 25 sept 2026 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended… |
| CVE-2026-92609 | Crítica (9.8) | 0.38% | — | 25 sept 2026 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication.… |
| CVE-2026-92608 | Alta (7.5) | 0.32% | — | 25 sept 2026 | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt delivery to AMQP 0-10 consumers via message properties that the target… |
| CVE-2026-68080 | Media (6.5) | 0.65% | — | 5 ago 2026 | It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache… |
| CVE-2026-68078 | Media (6.5) | 0.65% | — | 5 ago 2026 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache… |
| CVE-2026-68077 | Media (6.5) | 0.65% | — | 5 ago 2026 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J:… |
| CVE-2026-68075 | Media (6.5) | 0.65% | — | 5 ago 2026 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to… |
| CVE-2026-68073 | Alta (7.5) | 0.77% | — | 5 ago 2026 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade… |
| CVE-2026-68074 | Alta (7.5) | 0.77% | — | 5 ago 2026 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to… |
| CVE-2026-68060 | Alta (7.5) | 0.77% | — | 5 ago 2026 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended… |
| CVE-2019-0200 | Alta (7.5) | 3.8% | — | 6 mar 2019 | A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands… |
| CVE-2018-8030 | Alta (7.5) | 3.9% | — | 20 jun 2018 | A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB… |
| CVE-2018-1298 | Media (5.9) | 2.3% | — | 9 feb 2018 | A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The… |
| CVE-2017-15702 | Crítica (9.8) | 6.2% | — | 1 dic 2017 | In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated… |
| CVE-2017-15701 | Alta (7.5) | 4.4% | — | 1 dic 2017 | In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to… |
| CVE-2016-8741 | Alta (7.5) | 6.3% | — | 15 may 2017 | The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types.… |
| CVE-2016-4432 | Crítica (9.1) | 8.1% | — | 1 jun 2016 | The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state… |
| CVE-2016-3094 | Media (5.9) | 7.8% | — | 1 jun 2016 | PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.