Improper input validation in Apache Qpid Broker-J
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Why it matters now
EPSS 0.03787 90th percentileScored 2026-11-07
Fix Fixed org.apache.qpid:apache-qpid-broker-j (Maven): 7.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Qpid Broker-J | 7.0.0, 7.0.1, 7.0.2, 7.0.3 | — | No fix listed | CNA |
| — | org.apache.qpid:apache-qpid-broker-j (Maven) | 7.0.0 to before 7.1.0 | 7.1.0 | Patch available | GHSA-7xr3-rgwh-pw22 |
- Apache Qpid Broker-J VendorApache Affected 7.0.0, 7.0.1, 7.0.2, 7.0.3 Fixed in — No fix listed CNA
- org.apache.qpid:apache-qpid-broker-j (Maven) Vendor— Affected 7.0.0 to before 7.1.0 Fixed in 7.1.0 Patch available GHSA-7xr3-rgwh-pw22
Remediation
- Fix · GHSA-7xr3-rgwh-pw22 org.apache.qpid:apache-qpid-broker-j (Maven) Fixed in 7.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8030
- 2026-10-03 Alias added: GHSA-7xr3-rgwh-pw22
- 2026-10-26 EPSS moved to the 50th–90th percentile
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-11-04 EPSS moved to the 90th–95th percentile
References
Advisory 2
Other 5
- [qpid-users] 20180618 [SECURITY] [CVE-2018-8030] Apache Qpid Broker-J Denial of Service Vulnerability when AMQP 0-8...0-91 messages
- https://github.com/apache/qpid-broker-j/commit/025b48f3193e2b10b1c41d2bc3bcfc9cfc238a27
- https://github.com/apache/qpid-broker-j
- https://issues.apache.org/jira/browse/QPID-8203
- https://lists.apache.org/thread.html/1089a4f351a1bdca0618199e53bceeec59a10bf4e3008018d6949876@%3Cusers.qpid.apache.org%3E
More Apache Qpid Broker-j vulnerabilities
- TI-2017-11476 In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different… CVSS 3.1CRITICAL 9.8
- TI-2016-03808 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3… CVSS 3.1CRITICAL 9.1
- TI-2026-62463 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication CVSS 3.1CRITICAL 9.8
- TI-2016-07198 Information disclosure in Apache Qpid Broker-J CVSS 3.1HIGH 7.5
- TI-2026-47855 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
- TI-2026-47854 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2018-8030 · CVE Program
- CVE-2018-8030 · NVD
- FIRST EPSS
- GHSA-7xr3-rgwh-pw22 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences