The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3)…
Priority LOW 36CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Why it matters now
EPSS 0.04267 91st percentileScored 2026-11-07
Fix Fixed org.apache.qpid:proton-j (Maven): 0.12.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.qpid:proton-j (Maven) | before 0.12.1 | 0.12.1 | Patch available | GHSA-f5cf-f7px-xpmh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.qpid:proton-j (Maven) Vendor— Affected before 0.12.1 Fixed in 0.12.1 Patch available GHSA-f5cf-f7px-xpmh
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:qpid_proton:*:*:*:*:*:*:*:* | up to 0.12.0 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* | 23 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:qpid_proton:*:*:*:*:*:*:*:* Versions up to 0.12.0 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-f5cf-f7px-xpmh org.apache.qpid:proton-j (Maven) Fixed in 0.12.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.3 | Fixed | — |
| Red Hat Satellite 6.3 - Puppet 4 | Fixed | — |
| Red Hat Satellite Capsule 6.3 | Fixed | — |
| Red Hat Satellite Capsule 6.3 - Puppet 4 | Fixed | — |
Not affected: 5 products
- Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
- Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
- Red Hat Enterprise MRG 3
- Red Hat OpenStack Platform 8 (Liberty)
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2016-2166
- 2026-10-03 Alias added: GHSA-f5cf-f7px-xpmh
References
Advisory 4
Other 5
- https://issues.apache.org/jira/browse/PROTON-1157
- https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git%3Bh=a058585
- [qpid-commits] 20190423 [qpid-site] branch asf-site updated: update site content for CVE-2019-0223
- https://git-wip-us.apache.org/repos/asf?p=qpid-proton.git;h=a058585
- https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d@%3Ccommits.qpid.apache.org%3E
Sources
- CVE-2016-2166 · CVE Program
- CVE-2016-2166 · NVD
- FIRST EPSS
- GHSA-f5cf-f7px-xpmh · GitHub Advisory Database · CC BY 4.0
- CVE-2016-2166 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences