A pre‑authentication attacker can send deeply nested data types to Apache Qpid ProtonJ2, causing the application to throw a StackOverflowError. This error can crash the process and expose the service to interruptions. The weakness is identified as CWE‑674, which signifies unbounded recursion leading to stack exhaustion. The direct result is a denial of service that may affect availability of the messaging broker. The impact does not include compromise of data confidentiality or integrity, but it can lead to service outages or forced restarts.

The vulnerability affects the Apache Qpid ProtonJ2 messaging library as distributed by Apache Software Foundation. All versions through 1.1.0 are susceptible. The fix is included in ProtonJ2 1.2.0 and later releases, which should be deployed by affected users.

The attack vector is pre‑authentication, so an attacker can trigger the exploit by just connecting to the service and sending specially crafted nested types. No public exploit code is available; the EPSS score is not reported, and the issue is not listed in the CISA KEV catalog. Because a stack overflow will crash the broker, the risk of denial of service is high for systems that rely on continuous availability. The lack of an existing mitigation outside of upgrading the library suggests that the best protection is to move to the fixed version promptly.