Read the docs
TI-2019-00176 Aliases CVE-2019-0200GHSA-c9h6-xhg9-xxrv

Improper input validation in Apache Qpid Broker-J

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.

Why it matters now

EPSS 0.03847 90th percentileScored 2026-11-07
Fix Fixed org.apache.qpid:apache-qpid-broker-j (Maven): 7.0.7, 7.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Qpid Broker-JApache Qpid Broker-J 6.0.0 to 7.0.6 (inclusive), 7.1.0—No fix listedCNA
—org.apache.qpid:apache-qpid-broker-j (Maven)before 7.0.77.0.7Patch availableGHSA-c9h6-xhg9-xxrv
—org.apache.qpid:apache-qpid-broker-j (Maven)7.1.0 to before 7.1.17.1.1Patch availableGHSA-c9h6-xhg9-xxrv
  • Apache Qpid Broker-J VendorApache Affected Apache Qpid Broker-J 6.0.0 to 7.0.6 (inclusive), 7.1.0 Fixed in — No fix listed CNA
  • org.apache.qpid:apache-qpid-broker-j (Maven) Vendor— Affected before 7.0.7 Fixed in 7.0.7 Patch available GHSA-c9h6-xhg9-xxrv
  • org.apache.qpid:apache-qpid-broker-j (Maven) Vendor— Affected 7.1.0 to before 7.1.1 Fixed in 7.1.1 Patch available GHSA-c9h6-xhg9-xxrv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:*6.0.0 – 7.0.6VulnerableApache
cpe:2.3:a:apache:qpid_broker-j:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableApache
  • cpe:2.3:a:apache:qpid_broker-j:*:*:*:*:*:*:*:* Versions 6.0.0 – 7.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:qpid_broker-j:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-c9h6-xhg9-xxrv org.apache.qpid:apache-qpid-broker-j (Maven) Fixed in 7.0.7 Advisory →
  • Fix · GHSA-c9h6-xhg9-xxrv org.apache.qpid:apache-qpid-broker-j (Maven) Fixed in 7.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise MRG 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0200
  2. 2026-10-03 Alias added: GHSA-c9h6-xhg9-xxrv
  3. 2026-10-23 EPSS moved to the 90th–95th percentile
  4. 2026-10-25 EPSS moved to the 50th–90th percentile
  5. 2026-10-28 EPSS moved to the 90th–95th percentile

References

Advisory 2

Other 2

  • TI-2017-11476 In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different… CVSS 3.1CRITICAL 9.8
  • TI-2016-03808 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3… CVSS 3.1CRITICAL 9.1
  • TI-2026-62463 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication CVSS 3.1CRITICAL 9.8
  • TI-2016-07198 Information disclosure in Apache Qpid Broker-J CVSS 3.1HIGH 7.5
  • TI-2026-47855 Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-47854 Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences