CVE-2026-67592

Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

View on CVE.org
Published Aug 5, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid ProtonJ2: through 1.1.0.

Users are recommended to upgrade to version 1.2.0, which fixes the issue

Analysis

AI-generated

Technical impact

The vulnerability prevents the governance of maximum transfer frames per incoming delivery, allowing an authenticated attacker to deliver an excessive number of transfer frames, leading to elevated resource consumption and a potential denial of service. The impact is a loss of availability due to resource exhaustion, affecting system stability for affected users.

Affected Systems

The affected product is Apache Qpid ProtonJ2 from the Apache Software Foundation. All releases through 1.1.0 are vulnerable, and the issue is fixed in version 1.2.0.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity for this vulnerability. It requires authentication, so only authorized users who can establish connections can exploit the resource exhaustion. The EPSS score is <1%, and the vulnerability is not listed in CISA KEV, suggesting that exploitation would likely require intentional abuse rather than exploitation of a default or publicly exposed interface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later.
  • If an immediate upgrade is infeasible, restrict authenticated access by limiting users that can establish connections, and monitor for abnormal transfer frame activity indicating abuse.
  • Implement general resource‑limit best practices, such as configuring system kernel limits or container quotas, to mitigate the effect of excessive transfer frames in case a temporary workaround is needed.

Generated by OpenCVE AI on August 5, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Apache qpid Proton-j
Vendors & Products Apache qpid Proton-j
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate
Type Values Removed Values Added
Description It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue
Title Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery
Weaknesses CWE-770
References
Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
apache
Published
Updated
Aug 5, 2026, 3:20 PM
Reserved
Jul 29, 2026, 8:30 PM

View source JSON

Updated
Aug 5, 2026, 6:58 AM

JSON

Status
Analyzed
Published
Aug 5, 2026, 7:16 AM
Modified
Oct 24, 2026, 4:10 PM

View source JSON

Severity
Moderate
Public date
Aug 5, 2026, 5:44 AM

View source Bugzilla JSON

Updated
Aug 11, 2026, 2:15 PM

JSON