org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol 10.0.0

Direct Vulnerabilities

Known vulnerabilities in the org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded symbol value caching in the AMQP 1.0 `Symbol` codec. An attacker can exhaust broker resources by sending pre-authentication AMQP 1.0 traffic that forces the codec to create and retain a large number of distinct symbol values. The vulnerable path is in the AMQP 1.0 protocol handling code under `broker-plugins/amqp-1-0-protocol`, where symbol decoding caches values during message and type parsing. Repeatedly supplying many unique symbols causes the cache to grow without limit, consuming memory until the broker slows down or becomes unavailable. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unchecked AMQP 1.0 list and map size/count handling in the `ListConstructor` and `MapConstructor` codec classes. An attacker can trigger excessive allocation and parser work by sending a malformed pre-authentication AMQP message with invalid collection metadata. Because message decoding happens before authentication in the AMQP 1.0 receiving path, a remote client can exhaust broker resources simply by delivering crafted protocol frames, causing the broker to slow down, fail message processing, or become unavailable. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)
H Unchecked Input for Loop Condition Affected versions of this package are vulnerable to Unchecked Input for Loop Condition through the AMQP 1.0 disposition processing in `Session_1_0` and the delivery registry. An authenticated attacker can exhaust CPU by sending a disposition frame with a large or illegal delivery range, which drives naive range handling during disposition processing. This can slow or stall the broker for other users and disrupt AMQP 1.0 message delivery. How to fix Unchecked Input for Loop Condition? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)
H Insufficient Control of Network Message Volume (Network Amplification) Affected versions of this package are vulnerable to Insufficient Control of Network Message Volume (Network Amplification) due to excessive echo flow response handling in the `SendingLinkEndpoint` flow-control path of the AMQP 1.0 broker protocol. An authenticated attacker can force the broker to spend excessive resources by sending AMQP 1.0 flow frames with `echo=true`, causing the broker to keep responding at an uncontrolled rate. This affects the broker’s AMQP 1.0 link handling for authenticated sessions, where repeated echo requests can drive unnecessary broker-side flow processing and degrade service for other users. How to fix Insufficient Control of Network Message Volume (Network Amplification)? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the AMQP 1.0 session flow control handling in the `Session_1_0` and related transfer-processing code. An authenticated attacker can exhaust the session incoming window by sending a stream of AMQP 1.0 transfers that the broker continues to process. When the incoming window is exceeded, the broker’s session-state handling is forced into excessive work and resource consumption, which can stall or disrupt the affected connection and degrade service for other users on the broker. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)
H Uncontrolled Recursion Affected versions of this package are vulnerable to Uncontrolled Recursion due to unchecked AMQP 1.0 type nesting in the `SectionDecoderImpl` and related codec constructors in `broker-plugins/amqp-1-0-protocol`. An unauthenticated attacker can trigger a `StackOverflowError` by sending a crafted AMQP 1.0 message with deeply nested types. This can crash or destabilize the broker process, interrupting message handling for connected users. How to fix Uncontrolled Recursion? Upgrade `org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol` to version 10.1.0 or higher.	[,10.1.0)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded symbol value caching in the AMQP 1.0 Symbol codec. An attacker can exhaust broker resources by sending pre-authentication AMQP 1.0 traffic that forces the codec to create and retain a large number of distinct symbol values. The vulnerable path is in the AMQP 1.0 protocol handling code under broker-plugins/amqp-1-0-protocol, where symbol decoding caches values during message and type parsing. Repeatedly supplying many unique symbols causes the cache to grow without limit, consuming memory until the broker slows down or becomes unavailable.

How to fix Allocation of Resources Without Limits or Throttling?