Read the docs
TI-2018-01202 Aliases CVE-2018-1298GHSA-6w3v-66mj-2qm6

Improper input validation in Apache Qpid Broker-J

Priority LOW 31CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.

Why it matters now

EPSS 0.02329 83rd percentileScored 2026-11-07
Fix Fixed org.apache.qpid:apache-qpid-broker-j (Maven): 7.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Qpid Broker-J7.0.0—No fix listedCNA
—org.apache.qpid:apache-qpid-broker-j (Maven)7.0.0 to before 7.0.17.0.1Patch availableGHSA-6w3v-66mj-2qm6
  • Apache Qpid Broker-J VendorApache Affected 7.0.0 Fixed in — No fix listed CNA
  • org.apache.qpid:apache-qpid-broker-j (Maven) Vendor— Affected 7.0.0 to before 7.0.1 Fixed in 7.0.1 Patch available GHSA-6w3v-66mj-2qm6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:qpid_broker-j:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableApache
  • cpe:2.3:a:apache:qpid_broker-j:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-6w3v-66mj-2qm6 org.apache.qpid:apache-qpid-broker-j (Maven) Fixed in 7.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise MRG 2
  • Red Hat Enterprise MRG 3
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss Fuse 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1298
  2. 2026-10-03 Alias added: GHSA-6w3v-66mj-2qm6

References

Advisory 2

Other 2

  • TI-2017-11476 In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different… CVSS 3.1CRITICAL 9.8
  • TI-2016-03808 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3… CVSS 3.1CRITICAL 9.1
  • TI-2026-62463 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication CVSS 3.1CRITICAL 9.8
  • TI-2016-07198 Information disclosure in Apache Qpid Broker-J CVSS 3.1HIGH 7.5
  • TI-2026-47855 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-47854 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences