The vulnerability resides in Apache Qpid ProtonJ2 where size and count fields in certain message types are not properly validated before memory allocation. An attacker can send a crafted request that forces the server to allocate an excessively large amount of memory, potentially exhausting resources and causing a denial of service. This flaw is classified as CWE-789, an integer overflow or out-of-bounds allocation weakness, and as CWE-770, an excessive allocation vulnerability.

The affected product is Apache Qpid ProtonJ2 from the Apache Software Foundation. All releases up to and including version 1.1.0 are vulnerable, whereas version 1.2.0 and later contain the fix. Administrators running ProtonJ2 should identify their installed version and plan an upgrade accordingly.

The flaw can be triggered by a pre-authentication message that requests excessive memory allocation. The conditions for exploitation require that a client can send such a message to the ProtonJ2 service; it is inferred that any network entity capable of sending data to the service can potentially trigger the vulnerability. The CVSS score of 7.5 indicates high severity, the EPSS score is not available and the vulnerability is not listed in CISA KEV, so the likelihood of exploitation remains uncertain, but the impact on availability is significant.