CVE-2019-0200 Improper Input Validation in Apache Qpid Broker-J
Unauthenticated attackers can crash the Apache Qpid Broker-J instance by sending specially crafted AMQP commands, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-0200?
CVE-2019-0200 is a high-severity denial of service vulnerability in Apache Qpid Broker-J, published on 6 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Which versions are affected by CVE-2019-0200?
4 open source packages ship an affected version, including org.apache.qpid:apache-qpid-broker-j. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.qpid:apache-qpid-broker-j Maven | All versions | 7.0.7 |
org.apache.qpid:apache-qpid-broker-j Maven | All versions | 7.0.7 |
org.apache.qpid:apache-qpid-broker-j Maven | From 7.1.0 | 7.1.1 |
org.apache.qpid:apache-qpid-broker-j Maven | From 7.1.0 | 7.1.1 |
Products include Apache Qpid Broker-J.
How do I fix CVE-2019-0200?
Upgrade org.apache.qpid:apache-qpid-broker-j to a fixed version for your release line: 7.0.7 or 7.1.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-0200 being exploited?
There is no known exploitation of CVE-2019-0200 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Broker-J
- CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
- CVE-2017-15702 Apache Qpid Broker vulnerable to authentication port spoofing
- CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
- CVE-2026-92550 Denial of service in Apache Qpid Broker-J
- CVE-2026-92560 Denial of service in Apache Qpid Broker-J
Sources
Also known as GHSA-c9h6-xhg9-xxrv.