CVE-2016-3094
Improper Input Validation in org.apache.qpid:qpid-broker
CVE-2016-3094 is a medium vulnerability (CVSS 5.9) in Apache Qpid Broker-j, published June 1, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.83%, the 94th percentile. Fixed in org.apache.qpid:qpid-broker 6.0.3.
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
CVE-2016-3094- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20, CWE-287
- Updated
- 2026-11-02
CVE List No score
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
CVE-2016-3094- Updated
- 2026-11-02
EUVDEUVD-2018-0632 No score
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
EUVD-2018-0632- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jj9h-mwhq-8vhm
Improper Input Validation in org.apache.qpid:qpid-broker
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
GHSA-jj9h-mwhq-8vhm- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-287
- Updated
- 2026-11-02
OSV
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
CVE-2016-3094- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-jj9h-mwhq-8vhm
Improper Input Validation in org.apache.qpid:qpid-broker
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
GHSA-jj9h-mwhq-8vhm- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3094
PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
- Record
UBUNTU-CVE-2016-3094- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.qpid:qpid-brokerMaven |
before 6.0.3 | 6.0.3 |
org.apache.qpid:qpid-brokerMaven |
before 6.0.3, plus listed versions 0.140.160.180.200.22 Show 8 moreShow less0.240.260.280.300.326.0.06.0.16.0.2 |
6.0.3 |
qpid-cppUbuntu:16.04:LTS |
All versions, plus listed versions 0.16-9build10.16-9ubuntu10.16-9ubuntu2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
issues.apache.org/jira/browse/QPID-7271
svn.apache.org/viewvc?view=revision&revision=1744403
securitytracker.com/id/1035982
packetstormsecurity.com/files/137215/Apache-Qpid-Java-Broker-6.0.2-Denial-Of-Service.html
qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html
securityfocus.com/archive/1/538507/100/0/threaded