Apache Software Foundation Qpid Proton-j vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apache Software Foundation Qpid Proton-j: 6 record(s), with affected versions and fixes.
cpe:2.3:a:apache:qpid_proton-j

CVE-2026-66277 Medium · 6.5 CWE-770 Aug 5, 2026

Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVE-2026-66276 Medium · 6.5 CWE-606 Aug 5, 2026

Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVE-2026-66275 Medium · 6.5 CWE-770 Aug 5, 2026

Apache Qpid Proton-J: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVE-2026-66274 High · 7.5 CWE-674 Aug 5, 2026

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVE-2026-66273 High · 7.5 CWE-789 Aug 5, 2026

Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVE-2026-66257 High · 7.5 CWE-770 Aug 5, 2026

Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.