CVE-2017-15701: Apache Qpid Broker-J

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.

Affected products

• Apache Qpid Broker-J: from 6.1.0, up to and including 6.1.4

Published 2017-12-01. Last modified 2026-06-17.