CVE-2026-67553
MEDIUM
CVSS 6.5
Java
Verified Advisory
Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)
An authenticated attacker can exceed the session flow control incoming window in Apache Qpid Proton Dotnet, potentially leading to denial of service. The vulnerability exists in all versions through 1.0.0 and requires authentication to exploit.
Affected versions:
- Apache Qpid Proton Dotnet (org.apache.qpid) through 1.0.0
We recommend updating to: 1.1.0.
CVSS ? · our assessment: act_now
Reference: https://seclists.org/oss-sec/2026/q3/424
Details: https://vuln.today/cve/CVE-2026-67553
Verified by vuln.today against published advisories.
Affected versions
- – Apache Qpid Proton Dotnet (org.apache.qpid) through 1.0.0
Fixed in: 1.1.0
More advisories for Java
- CVE-2026-35482 – Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
- CVE-2026-70440 – Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
- CVE-2026-70427 – Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
- CVE-2026-70432 – Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
- CVE-2026-70429 – Unicode username normalization bypass in Jenkins (CVE-2026-70429)
- CVE-2026-70431 – Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
- CVE-2026-70426 – Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
- CVE-2026-67552 – Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)