CVE-2016-3094

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.

Date published : 2016-06-01

http://www.securityfocus.com/archive/1/538507/100/0/threaded

http://qpid.apache.org/releases/qpid-java-6.0.3/release-notes.html