CVE-2017-15701 Apache Qpid Broker-J vulnerable to Denial of Service (DoS) via uncontrolled resource consumption

What is CVE-2017-15701?

CVE-2017-15701 is a high-severity vulnerability in Apache Qpid Broker-J, published on 1 Dec 2017.

Official description

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.

Weakness: CWE-400

Which versions are affected by CVE-2017-15701?

2 open source packages ship an affected version, including org.apache.qpid:qpid-broker. It affects 1 product.

Products include Apache Qpid Broker-J.

How do I fix CVE-2017-15701?

Upgrade org.apache.qpid:qpid-broker to 6.1.5 or later.

Is CVE-2017-15701 being exploited?

There is no known exploitation of CVE-2017-15701 in the wild and no public exploit code.

Other vulnerabilities in Apache Qpid Broker-J

• CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication Critical 9.8
• CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing Critical 9.8
• CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication Critical 9.1
• CVE-2026-92550 Denial of service in Apache Qpid Broker-J High 7.5
• CVE-2026-92560 Denial of service in Apache Qpid Broker-J High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4r7g-7cpj-5jr7.