Improper Input Validation in org.apache.qpid:qpid-broker

MEDIUM 5.9CVE-2016-3094 · GHSA-jj9h-mwhq-8vhm · Published 01/06/2016 · updated 17/06/2026

In short

CVE-2016-3094 is a MEDIUM (CVSS 5.9) vulnerability affecting org.apache.qpid:qpid-broker, qpid broker-j (apache).
Chance of exploitation in the next 30 days (EPSS): 7.8%, higher than 94.7% of all vulnerabilities.
Fix: update to 6.0.3 or later.

Package	Affected versions	Patched versions
org.apache.qpid:qpid-broker Maven	`< 6.0.3`	`6.0.3`
qpid broker-j apache	`≤ 6.0.2`	No fix yet

Description

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-3094 · ADVISORY
GitHub Advisory GHSA-jj9h-mwhq-8vhm · ADVISORY
issues.apache.org/jira/browse/QPID-7271 · WEB
svn.apache.org/viewvc · WEB
mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E · WEB
packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html · WEB
qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html · WEB
securityfocus.com/archive/1/538507/100/0/threaded · WEB
securitytracker.com/id/1035982 · WEB

More vulnerabilities in org.apache.qpid:qpid-broker

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.qpid:qpid-broker

Maven

< 6.0.3

6.0.3

qpid broker-j

apache

≤ 6.0.2

No fix yet

Description

NVD description

More vulnerabilities in org.apache.qpid:qpid-broker

See all →