Description
Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | python-qpid | 0.14-11.el6_3 | RHSA-2012:1269 |
| RHEL 6 | qpid-cpp +4 | 0.14-22.el6_3 | RHSA-2012:1269 |
| RHEL 6 | qpid-qmf +2 | 0.14-14.el6_3 | RHSA-2012:1269 |
| RHEL 6 | qpid-tools | 0.14-6.el6_3 | RHSA-2012:1269 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | mrg-release | 2.2.0-1.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | python-qpid | 0.14-11.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-cpp-mrg +12 | 0.14-22.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-jca +5 | 0.18-2.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-qmf +3 | 0.14-14.el5 | RHSA-2012:1277 |
| Red Hat MRG 2 | qpid-tools | 0.14-6.el5 | RHSA-2012:1277 |
Advisories 2
- RHSA-2012:1269 Red Hat Security Advisory: qpid security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1277 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.2 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://issues.apache.org/jira/browse/QPID-4021
- RHSA-2012:1277 vendor-advisory
- RHSA-2012:1269 vendor-advisory
- 50699 third-party-advisory
- 50698 third-party-advisory
- apache-qpid-broker-dos(78730) vdb-entry
- 55608 vdb-entry
- 50573 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=817175
- https://issues.apache.org/jira/browse/QPID-2616