Description
In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Broker-J | 6.1.0, 6.1.1, 6.1.2, 6.1.3, and 6.1.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.qpid:qpid-broker | >= 6.1.0, < 6.1.5 | 6.1.5 | GHSA-4r7g-7cpj-5jr7 |