CVE-2019-0200 — qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service

Back Back to CVE browser

HIGH

qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service

Published Mar 6, 2019

7.5

HIGH

CVSS 3.0

EPSS 3.82%

Description

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.

Affected products

Vendor Apache Software Foundation Product Apache Qpid Broker-J Default
n/a
- Version
  Apache Qpid Broker-J 6.0.0 to 7.0.6 (inclusive), 7.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Qpid Broker-J

n/a

Version	Status	Constraints
Apache Qpid Broker-J 6.0.0 to 7.0.6 (inclusive), 7.1.0	affected	-

Product	Package	State	Advisory
Red Hat Enterprise MRG 3	qpid-java	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

3.82% 0.03815

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03815

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.82% (0.03815)	89.72th	v5 (v2026.06.15)
Jun 15, 2026	3.82% (0.03815)	88.65th	v5 (v2026.06.15)
Mar 30, 2025	2.92% (0.02923)	85.17th	v4 (v2025.03.14)
Mar 29, 2025	4.21% (0.04209)	80.90th	v4 (v2025.03.14)
Mar 17, 2025	2.96% (0.02955)	85.56th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00070)	32.57th	v3 (v2023.03.01)
Jun 13, 2024	0.07% (0.00070)	30.48th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00070)	28.46th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	9.56% (0.09564)	87.11th	v1
Jan 6, 2022	9.56% (0.09564)	86.96th	v1
Sep 1, 2021	2.30% (0.02303)	78.06th	v1
Apr 14, 2021	2.30% (0.02303)	0.00th	v1

Weaknesses (1)

CWE-20

Improper Input Validation

References (8)

http://www.securityfocus.com/bid/107215
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2019-0200
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1685179
Issue Tracking
https://github.com/advisories/GHSA-c9h6-xhg9-xxrv
Advisory
https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de%40%3Cusers.qpid.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de@%3Cusers.qpid.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-0200
https://www.cve.org/CVERecord?id=CVE-2019-0200

Link	Providers	Tags
http://www.securityfocus.com/bid/107215		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2019-0200		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1685179		Issue Tracking
https://github.com/advisories/GHSA-c9h6-xhg9-xxrv		Advisory
https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de%40%3Cusers.qpid.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de@%3Cusers.qpid.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-0200
https://www.cve.org/CVERecord?id=CVE-2019-0200