What is CVE-2016-2166?

CVE-2016-2166 is a medium-severity vulnerability in Apache Qpid Proton, classified under Information Disclosure. CVSS score: 6.5/10. Published 2016-04-12.

How severe is CVE-2016-2166?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2016-2166 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in Apache Qpid Proton

CVE-2016-2166

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.

Vulnerability class: Information Disclosure

Published 2016-04-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N.

EPSS exploit prediction

EPSS: 0.043 (90.7th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.043 · newest: 0.043 · change: 0.000

Affected products

Apache Qpid Proton
Fedoraproject Fedora — versions 23

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

issues.apache.org/jira/browse/PROTON-1157 (Issue Tracking)
packetstormsecurity.com/files/136403/Apache-Qpid-Proton-0.12.0-SSL-Failure.html (Third Party Advisory)
lists.fedoraproject.org/pipermail/package-announce/2016-April/182414.html (vendor-advisory, Third Party Advisory)
git-wip-us.apache.org/repos/asf
qpid.apache.org/releases/qpid-proton-0.12.1/release-notes.html (Patch, Vendor Advisory)
www.securityfocus.com/archive/1/537864/100/0/threaded (mailing-list)
lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d… (mailing-list)

Frequently asked questions

What is CVE-2016-2166?: CVE-2016-2166 is a medium-severity vulnerability in Apache Qpid Proton, classified under Information Disclosure. CVSS score: 6.5/10. Published 2016-04-12.
How severe is CVE-2016-2166?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2016-2166 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.