CVE-2026-67592highCWE-770

CVE-2026-67592: high-severity vulnerability in Apache Qpid ProtonJ2

Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

Published

Follow this CVE+ Monitor Apache Qpid ProtonJ2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache Qpid ProtonJ2
Related CVEs — Apache Qpid ProtonJ2

In the same product, most dangerous first.

CVE-2026-67590HIGHApache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflowEPSS 0.8%CVE-2026-67589HIGHApache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authenticationEPSS 0.8%CVE-2026-67588HIGHApache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustionEPSS 0.8%CVE-2026-67591MEDIUMApache Qpid ProtonJ2: Incoming session flow control window can be exceededEPSS 0.7%