EUVD-2026-53055
GHSA-wr2r-m36x-734x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-authentication network reachability with no privileges or user interaction; impact is exclusively heap exhaustion DoS, with no confidentiality or integrity consequence.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Excessive heap allocation in Apache Qpid Proton-J's AMQP type parser exposes any network-accessible AMQP endpoint to unauthenticated denial-of-service before an authentication handshake completes. Malformed AMQP frames containing attacker-controlled size or count field values cause the Java library to allocate unbounded memory, leading to JVM heap exhaustion and service crash. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the pre-authentication attack vector and zero-privilege requirement make this a high-priority patch target for any internet-exposed Proton-J deployment.
Technical ContextAI
Apache Qpid Proton-J is the Java implementation of the Apache Qpid Proton AMQP messaging toolkit, providing AMQP 1.0 wire-protocol support for Java applications including brokers and messaging clients. AMQP 1.0 uses a binary type encoding scheme where compound and array types carry explicit size and count fields in their frame headers; these values are intended to describe the byte length and element count of subsequent data. The root cause is the library's failure to bound-check or sanitize these attacker-supplied size or count values before performing allocations - allowing a malicious peer to specify arbitrarily large values that cause the JVM to attempt correspondingly large heap allocations. This is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling), though no CWE was assigned in the available data. Critically, this parsing occurs in the pre-authentication code path, meaning the vulnerability is reachable before any credential exchange or session validation takes place.
RemediationAI
Upgrade Apache Qpid Proton-J to the patched version identified in the Apache Qpid security advisory at https://seclists.org/oss-sec/2026/q3/409 - the exact fixed version number is not confirmed in the available data and must be obtained from the official advisory before applying. As an immediate compensating control, restrict network access to AMQP ports (default 5671 for TLS, 5672 for plaintext) to trusted IP ranges using firewall rules or network policy; this is the most effective mitigation and has no functional side effects for properly segmented deployments. If the AMQP service is not required to be externally accessible, bind it to internal interfaces only. Implement connection rate limiting at the network perimeter or load-balancer level to slow the rate at which an attacker can trigger allocations - this does not eliminate the vulnerability but raises the cost of a sustained DoS. Monitor JVM heap utilization and configure alerts for abnormal growth patterns to enable rapid detection of exploitation attempts.
More in Qpid Proton J
View allResource exhaustion leading to denial of service in Apache Qpid Proton-J through 0.34.1 can be triggered by a pre-authen
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.s
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today