Every CVE whose affected-product data names Apache Qpid Broker-j, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (15)
CVE-2017-15702 — CVSS 9.8 (critical): In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of…
CVE-2016-4432 — CVSS 9.1 (critical): The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass…
CVE-2017-15701 — CVSS 7.5 (high): In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0…
CVE-2026-68074 — CVSS 7.5 (high): A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This…
CVE-2018-8030 — CVSS 7.5 (high): A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to…
CVE-2019-0200 — CVSS 7.5 (high): A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an…
CVE-2026-68073 — CVSS 7.5 (high): A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This…
CVE-2026-68060 — CVSS 7.5 (high): A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service…
CVE-2016-8741 — CVSS 7.5 (high): The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among…
CVE-2026-68080 — CVSS 6.5 (medium): It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause…
CVE-2026-68077 — CVSS 6.5 (medium): An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range…
CVE-2026-68078 — CVSS 6.5 (medium): It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause…
CVE-2026-68075 — CVSS 6.5 (medium): An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue…
CVE-2018-1298 — CVSS 5.9 (medium): A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP…
CVE-2016-3094 — CVSS 5.9 (medium): PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers…