AI analysis
Apache Qpid Broker-J through 10.1.0 processes GZIP-compressed data without any limit on decompressed output size in the shared decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated user with the ability to publish messages can submit a small, highly compressed payload (a 'decompression bomb') that expands enormously in memory, exhausting the broker's heap and disrupting availability. The impact is denial of service against the broker itself, not data disclosure or code execution, but the same flaw is reachable through multiple paths including the HTTP management interface's JSON rendering. All users running Broker-J 10.1.0 or earlier are affected; version 10.1.1 fixes the issue. No public proof of concept or observed exploitation is known, and the issue is not in the CISA KEV catalog.
What to do: Upgrade Apache Qpid Broker-J to version 10.1.1, which enforces a decompressed-output limit. Until patched, restrict which authenticated clients may publish to the broker, disable or tightly limit access to the HTTP management API, and monitor broker memory and message sizes for unusually small compressed messages causing large allocations. Since exploitation requires valid producer credentials, review authentication logs for accounts publishing anomalous compressed payloads.
Affected
| Apache Qpid Broker-J | through 10.1.0 (all versions up to and including 10.1.0) |
Estimated exposure
nichelikely low thousands of deployments worldwide, with only a small subset internet-exposed — Apache Qpid Broker-J is a niche open-source AMQP broker with no published install counts; public internet scans typically show only a small number of exposed AMQP broker instances attributed to Qpid, and message brokers are commonly…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion and HTTP management JSON rendering allows authenticated message producers to exhaust memory and disrupt broker availability via processing without a decompressed-output limit. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue.