Uncontrolled Resource Consumption

Apache Qpid ProtonJ2 is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the lack of a limit on the number of transfer frames per incoming delivery, which allows an authenticated attacker to cause excessive resource consumption and potentially trigger a denial-of-servi...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to resource exhaustion. The vulnerability is due to unbounded symbol value caching, where symbol values are cached without size limits and a pre-authentication attacker can send crafted input to exhaust resources, leading to denial of service...

org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service DoS for legitimate users...

Important: Red Hat Security Advisory: AMQ Clients 2026.Q3

An update is now available for Red Hat AMQ Clients Red Hat Product Security has rated this update as having an impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Referenc...

qpid-protonj2: Apache Qpid ProtonJ2: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service...

org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service DoS, making the affected system unavailable to legitimate users...

CVE-2026-67590

A flaw was found in Apache Qpid ProtonJ2. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the application to become unresponsive and resulting in a denial of service...

CVE-2026-67591

A flaw was found in Apache Qpid ProtonJ2. An authenticated attacker can exploit this vulnerability by exceeding the session flow control incoming window. This can lead to a denial of service DoS, making the system unavailable to legitimate users. Mitigation Ensure authenticated access to AMQP...

CVE-2026-67592

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67592

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67590

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67591

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

UBUNTU-CVE-2026-67592

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67592

A flaw was found in Apache Qpid ProtonJ2. An authenticated attacker could exploit a vulnerability where the system fails to limit the number of incoming data transfers. This oversight allows the attacker to consume excessive system resources, potentially leading to a denial of service DoS, which...

CVE-2026-67589

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

CVE-2026-67589

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service DoS, making the affected system unavailable to legitimate users...

CVE-2026-67588

A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, causing a denial of service DoS for legitimate users...

CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....

CVE-2026-67592 Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2....