Pre-Auth Memory-Exhaustion Denial of Service in Apache Qpid Broker-J AMQP 0-10 Decoder
AI analysis
Apache Qpid Broker-J through version 10.1.0 contains a resource-allocation flaw (CWE-770) in its AMQP 0-10 protocol decoder, where attacker-controlled type size and count values from incoming frames cause the broker to allocate excessive memory. Because the flaw is reachable before authentication completes, any remote attacker who can reach an AMQP port can send crafted AMQP 0-10 frames to drive the broker into memory exhaustion, crashing or hanging the service — a denial of service only, with no indication of code execution or data exposure. All deployments running Broker-J through 10.1.0 that expose the AMQP 0-10 protocol on a network-reachable port are affected. The issue is fixed in version 10.1.1, and no CVSS score, public proof of concept, or known in-the-wild exploitation exists at this time.
What to do: Upgrade Apache Qpid Broker-J to 10.1.1, which fixes the flaw. If immediate upgrade is not possible, firewall AMQP ports (default TCP 5672) so only trusted clients can connect, and disable the AMQP 0-10 protocol on broker ports if it is not required (AMQP 1.0 and 0-8..0-9-1 are unaffected transports to fall back to). Monitor broker JVM memory usage and restart behavior for signs of memory-exhaustion attempts.
Affected
| Apache Qpid Broker-J | through 10.1.0 (all versions up to and including 10.1.0) |
Estimated exposure
niche≈hundreds to low thousands of internet-exposed instances; total deployments including internal likely in the low tens of thousands — Qpid Broker-J is a niche open-source Java message broker with a small installed base relative to RabbitMQ/ActiveMQ/Kafka, and public internet scan engines typically show comparatively few exposed AMQP endpoints, with most broker…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.