CVE-2018-8030 Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents

What is CVE-2018-8030?

CVE-2018-8030 is a high-severity denial of service vulnerability in Apache Qpid Broker-J, published on 19 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.

Weakness: CWE-20

Which versions are affected by CVE-2018-8030?

2 open source packages ship an affected version, including org.apache.qpid:apache-qpid-broker-j. It affects 1 product.

Products include Apache Qpid Broker-J.

How do I fix CVE-2018-8030?

Upgrade org.apache.qpid:apache-qpid-broker-j to 7.1.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-8030 being exploited?

There is no known exploitation of CVE-2018-8030 in the wild and no public exploit code.

Other vulnerabilities in Apache Qpid Broker-J

• CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication Critical 9.8
• CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing Critical 9.8
• CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication Critical 9.1
• CVE-2026-92550 Denial of service in Apache Qpid Broker-J High 7.5
• CVE-2026-92560 Denial of service in Apache Qpid Broker-J High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7xr3-rgwh-pw22.