CVE-2009-5006: The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Br...

Security readout for executives and security teams

This flaw can let an authenticated user crash an Apache Qpid C++ message broker by changing exchange alternate settings. For organizations using affected broker versions, the business impact is service interruption, including possible cluster outage. It is old, version-specific, and there is no source evidence of active exploitation. Exposure is most likely in legacy Apache Qpid C++ Broker deployments earlier than 0.6, or Red Hat Enterprise MRG earlier than 1.3. Internet exposure matters less than authenticated broker access, especially users allowed to manage exchanges. Treat this as a legacy-platform availability risk. Prioritize remediation if affected Qpid or MRG brokers support production workflows, multi-tenant users, or critical clustered messaging. Otherwise, handle through normal vulnerability lifecycle and legacy software retirement. Mitigation focus: Identify Apache Qpid C++ Broker and Red Hat Enterprise MRG versions in use.; Upgrade affected Apache Qpid deployments to 0.6 or later where applicable.; Upgrade affected Red Hat Enterprise MRG deployments to 1.3 or later where applicable..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.