An authenticated attacker can construct a disposition frame containing large or illegal ranges, which the library processes with naive, unchecked range handling. This leads to exponentially increased CPU consumption and may eventually bring the messaging service to a halt. The flaw is classified as CWE-606, reflecting improper validation of input lengths.

Apache Qpid Proton‑J versions 0.34.1 and earlier are vulnerable. Any deployment of this C library that accepts disposition frames from authenticated clients is at risk, particularly when the broker or transport is exposed to networked users who can supply forged frames.

Exploitation requires prior authentication to the broker, so an attacker would need valid credentials or unprotected network access. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation under normal conditions. It is not listed in the CISA KEV catalog. The flaw may be mitigated by limiting access to the protocol and applying the vendor patch, but without the patch the library remains susceptible to resource exhaustion that could result in denial of service.