CVE-2017-15701

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate. Older AMQP protocols are not affected.

• CWE-400

• http://www.securityfocus.com/bid/102041Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/QPID-7947Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/4054e1c90993f337eeea24a312841c0661653e673c0ff8e2cd9520fe%40%3Cdev.qpid.apache.org%3E
• https://qpid.apache.org/cves/CVE-2017-15701.htmlMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/102041Third Party Advisory, VDB Entry
• https://issues.apache.org/jira/browse/QPID-7947Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/4054e1c90993f337eeea24a312841c0661653e673c0ff8e2cd9520fe%40%3Cdev.qpid.apache.org%3E
• https://qpid.apache.org/cves/CVE-2017-15701.htmlMitigation, Vendor Advisory

Published

Dec 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15696When an Apache Geode cluster before v1.4.0 is operating in s…
• CVE-2017-15697A malicious X-ProxyContextPath or X-Forwarded-Context header…
• CVE-2017-15698When parsing the AIA-Extension field of a client certificate…
• CVE-2017-15699A Denial of Service vulnerability was found in Apache Qpid D…6.5
• CVE-2017-1570IBM Jazz Foundation products could allow an authenticated us…
• CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirect…
• CVE-2017-15702In Apache Qpid Broker-J 0.18 through 0.32, if the broker is …9.8
• CVE-2017-15703Any authenticated user (valid client certificate but without…
• CVE-2017-15704Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-15705A denial of service vulnerability was identified that exists…
• CVE-2017-15706As part of the fix for bug 61201, the documentation for Apac…
• CVE-2017-15707In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an …