Technical impact
This vulnerability arises when the Proton-Dotnet library does not enforce a limit on the number of transfer frames it accepts for an incoming delivery. An attacker who has authenticated access can send a delivery comprised of an excessive number of transfer frames, depleting memory and processing resources. The result is a denial of service that can affect the stability of the application or the underlying host. The weakness is a classic resource exhaustion scenario (CWE-770).
Affected Systems
The flaw is present in any installation of Apache Qpid Proton-Dotnet up to and including version 1.0.0, regardless of the host platform, provided the component is exposed to authenticated clients. The recommendation is to upgrade to version 1.1.0, which contains the fix. The vendor is the Apache Software Foundation.
Risk and Exploitability
Because the library requires authentication, the attack surface is limited to users already granted access to the messaging service. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation has not been observed, but the lack of a frame limit makes the vulnerability inherently high‑severity once an attacker can connect. The CVSS score is 6.5, reflecting moderate severity, yet the absence of a transfer frame limit still poses a significant risk to availability when an authenticated attacker can send excessive frames.
