What is the CVSS score of CVE-2026-66257?

CVE-2026-66257 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Proton-J are affected by CVE-2026-66257?

Apache Qpid Proton-J (through version 0.34.1) contains a critical denial-of-service vulnerability allowing any network-accessible attacker to exhaust memory and crash services without authentication.

How to fix or mitigate CVE-2026-66257?

Within 24 hours: audit your environment to identify all systems running Apache Qpid Proton-J through 0.34.1, disable external AMQP connections where possible, and restrict network access to only trusted internal systems. Within 7 days: implement network segmentation to limit which systems can establish AMQP connections, deploy monitoring and alerting on memory consumption for affected processes, and establish per-connection rate limits. Within 30 days: monitor vendor advisories for patch availability and test alternative messaging libraries; if Qpid Proton-J is non-critical to operations, plan migration to eliminate the dependency entirely.

Apache Qpid Proton-J CVE-2026-66257

EUVD-2026-53051 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04

GHSA-g4xc-w2cq-f2f8

Denial Of Service Apache Red Hat Qpid Proton J

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable pre-auth attack with no complexity or privileges; impact is availability only, no confidentiality or integrity loss indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 14:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 04, 2026 - 18:16 vuln.today

CVE Published

Aug 04, 2026 - 17:57 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical DoS via Resource Exhaustion in Apache Qpid Proton-J - CVE-2026-66257 Aug 05, 2026

AnalysisAI

Resource exhaustion leading to denial of service in Apache Qpid Proton-J through 0.34.1 can be triggered by a pre-authentication attacker via unbounded AMQP symbol value caching. Any unauthenticated network peer capable of establishing an AMQP connection can send crafted frames that cause the library to cache symbol values without bound, consuming memory until the hosting process becomes unavailable. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Apache Qpid Proton-J (Maven artifact org.apache.qpid:proton-j) is a pure-Java implementation of the AMQP 1.0 protocol, widely embedded in message brokers, middleware, and JMS runtimes. The AMQP specification defines a 'symbol' type - UTF-8 encoded string identifiers used in protocol negotiation (capability names, descriptor keys, etc.). Proton-J's handling of incoming symbol frames prior to version 0.35.0 caches decoded symbol values in an unbounded data structure. Because this caching occurs during the pre-authentication phase of the AMQP connection handshake, an attacker can repeatedly send frames containing unique symbol values before any credentials are verified, causing heap memory growth proportional to the volume of crafted input. No CWE was assigned in the advisory, but the root cause class maps closely to CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling).

RemediationAI

Upgrade to Apache Qpid Proton-J version 0.35.0, which is the vendor-confirmed fix release per the oss-security advisory. Update the Maven dependency in pom.xml or equivalent build file to org.apache.qpid:proton-j:0.35.0 and redeploy all services embedding the library. If immediate upgrade is not feasible, the most actionable compensating control is network-layer restriction: place AMQP broker endpoints (default port 5672, TLS port 5671) behind firewall rules or mTLS gateways that limit connection sources to known trusted clients, thereby reducing the pre-auth attack surface. Connection rate-limiting or connection-count caps at the load balancer or OS level (e.g., iptables connlimit) can reduce the effectiveness of resource exhaustion but do not eliminate the vulnerability. Neither workaround eliminates the flaw - upgrade to 0.35.0 is the only definitive fix. Advisory references: https://seclists.org/oss-sec/2026/q3/408 and https://qpid.apache.org/.