CVE-2026-67589
HIGH
CVSS 7.5
Java
Verified Advisory
Pre-authentication denial of service in Apache Qpid ProtonJ2 (CVE-2026-67589)
A pre-authentication attacker can exploit improper type size/count handling in Apache Qpid ProtonJ2 to trigger excessive memory allocation, leading to potential denial of service. No authentication is required to exploit this vulnerability, making it remotely triggerable by unauthenticated parties.
Affected versions:
- Apache Qpid ProtonJ2 (org.apache.qpid:protonj2) through 1.1.0
We recommend updating to: 1.2.0.
CVSS ? · our assessment: act_now
Reference: https://seclists.org/oss-sec/2026/q3/428
Details: https://vuln.today/cve/CVE-2026-67589
Verified by vuln.today against published advisories.
Affected versions
- – Apache Qpid ProtonJ2 (org.apache.qpid:protonj2) through 1.1.0
Fixed in: 1.2.0
More advisories for Java
- CVE-2026-35482 – Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
- CVE-2026-70440 – Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
- CVE-2026-70427 – Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
- CVE-2026-70432 – Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
- CVE-2026-70429 – Unicode username normalization bypass in Jenkins (CVE-2026-70429)
- CVE-2026-70431 – Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
- CVE-2026-70426 – Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
- CVE-2026-67553 – Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)