CVE-2016-2166: Apache Qpid Proton

Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days.

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

Affected products

• Apache Qpid Proton: up to and including 0.12.0
• Fedoraproject Fedora: version 23 only

Published 2016-04-12. Last modified 2026-06-17.