23 matches found
CVE-2026-66275
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
CVE-2026-66276
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the...
CVE-2026-66257
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
CVE-2026-66273
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
CVE-2026-66277
Apache Qpid Proton-J is affected by CVE-2026-66277 through version 0.34.1, where the maximum number of transfer frames per incoming delivery could not be governed, allowing an authenticated attacker to cause excessive resource usage and potential denial of service. The issue affects Proton-J up t...
EUVD-2026-53093
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version...
CVE-2026-66276
The CVE-2026-66276 entry concerns Apache Qpid Proton-J. Affected up to version 0.34.1, where an authenticated attacker can craft a disposition frame with large or illegal ranges. The vulnerability stems from naive range handling, causing excessive CPU usage and leading to denial of service. impac...
CVE-2026-66275
The CVE affects Apache Qpid Proton-J up to version 0.34.1. An authenticated attacker could exceed the incoming session flow control window, potentially causing a denial of service. The issue is tied to flow control handling in the session/channel lifecycle. Upgrade to version 0.35.0 to fix the is...
EUVD-2026-53086
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
CVE-2026-66274
CVE-2026-66274 affects Apache Qpid Proton-J via unbounded type nesting that can cause a pre-authentication StackOverflowError, potentially enabling a denial of service. Affected: Proton-J up to and including 0.34.1. Root cause: unbounded nesting during type handling. Impact: pre-authentication cr...
CVE-2026-66257
Based on the CVE-2026-66257 entry, the issue affects Apache Qpid Proton-J up to version 0.34.1 and arises from an unbounded symbol value caching vulnerability that allows a pre-authentication resource exhaustion scenario, leading to potential denial of service. The documented mitigation is to upg...
CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
CVE-2026-66257
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...
EUVD-2018-0790
Malware in sbrugna...
GHSA-XVCH-R4WF-H8W9 Improper Certificate Validation in proton-j
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...
CVE-2018-17187
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...
CVE-2018-17187
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...
Default configuration
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...
CVE-2018-17187
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl...' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with option...