Information disclosure in Apache Qpid Broker-J
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Qpid Broker-J | 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5; 6.1.0 | — | No fix listed | CNA |
| — | org.apache.qpid:qpid-broker (Maven) | 6.0.0 to before 6.0.6 | 6.0.6 | Patch available | GHSA-8vvh-crqv-jm64 |
| — | org.apache.qpid:qpid-broker (Maven) | 6.1.0 to before 6.1.1 | 6.1.1 | Patch available | GHSA-8vvh-crqv-jm64 |
- Apache Qpid Broker-J VendorApache Affected 6.0.1, 6.0.2, 6.0.3, 6.0.4, and 6.0.5; 6.1.0 Fixed in — No fix listed CNA
- org.apache.qpid:qpid-broker (Maven) Vendor— Affected 6.0.0 to before 6.0.6 Fixed in 6.0.6 Patch available GHSA-8vvh-crqv-jm64
- org.apache.qpid:qpid-broker (Maven) Vendor— Affected 6.1.0 to before 6.1.1 Fixed in 6.1.1 Patch available GHSA-8vvh-crqv-jm64
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:qpid_broker-j:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:qpid_broker-j:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:qpid_broker-j:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:qpid_broker-j:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:qpid_broker-j:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:qpid_broker-j:6.1.0:*:*:*:*:*:*:* | 6.1.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:qpid_broker-j:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:qpid_broker-j:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:qpid_broker-j:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:qpid_broker-j:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:qpid_broker-j:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:qpid_broker-j:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·Apache
Remediation
- Fix · GHSA-8vvh-crqv-jm64 org.apache.qpid:qpid-broker (Maven) Fixed in 6.0.6 Advisory →
- Fix · GHSA-8vvh-crqv-jm64 org.apache.qpid:qpid-broker (Maven) Fixed in 6.1.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise MRG 2
- Red Hat Enterprise MRG 3
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8741
- 2026-10-03 Alias added: GHSA-8vvh-crqv-jm64
References
More Apache Qpid Broker-j vulnerabilities
- TI-2017-11476 In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different… CVSS 3.1CRITICAL 9.8
- TI-2016-03808 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3… CVSS 3.1CRITICAL 9.1
- TI-2026-62463 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication CVSS 3.1CRITICAL 9.8
- TI-2026-47855 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
- TI-2026-47854 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow CVSS 3.1HIGH 7.5
- TI-2026-47849 Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication CVSS 3.1HIGH 7.5
Sources
- CVE-2016-8741 · CVE Program
- CVE-2016-8741 · NVD
- FIRST EPSS
- GHSA-8vvh-crqv-jm64 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-8741 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences