What is the CVSS score of CVE-2026-66274?

CVE-2026-66274 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Proton-J are affected by CVE-2026-66274?

Apache Qpid Proton-J (through version 0.34.1) is vulnerable to remote denial-of-service attacks that can crash message broker services.

How to fix or mitigate CVE-2026-66274?

Within 24 hours: inventory all systems running Qpid Proton-J and map network exposure. Within 7 days: implement network-based access controls restricting AMQP ports to authorized internal systems, deploy message payload validation and size limits, and configure JVM monitoring for error conditions. Within 30 days: monitor vendor security advisories and develop a patch deployment plan for when updates become available; review infrastructure redundancy and restart mechanisms to limit service impact.

Apache Qpid Proton-J CVE-2026-66274

EUVD-2026-53082 HIGH

Uncontrolled Recursion (CWE-674)

2026-08-05 apache

GHSA-p2gc-fm5w-94jj

Apache Denial Of Service Apache Qpid Proton J Red Hat

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity DoS with no confidentiality or integrity impact; availability impact is high due to process crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 22:47 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 06, 2026 - 22:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 07:01 vuln.today

CVE Published

Aug 05, 2026 - 05:29 cve.org

HIGH

DescriptionCVE.org

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

AnalysisAI

Denial of service in Apache Qpid Proton-J through 0.34.1 allows unauthenticated remote attackers to crash the service by sending AMQP messages with deeply nested type structures that exhaust the JVM call stack via a StackOverflowError. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no user interaction required, targeting availability exclusively. No active exploitation has been confirmed - this vulnerability is absent from CISA KEV and carries a low EPSS score of 0.21% (11th percentile) - but the zero-prerequisite attack path warrants prompt patching for any internet-facing AMQP deployment.

Technical ContextAI

Apache Qpid Proton-J is an open-source Java implementation of the AMQP 1.0 messaging protocol, commonly embedded in enterprise messaging middleware such as Apache ActiveMQ Artemis and cloud-native messaging stacks. The root cause is CWE-674 (Uncontrolled Recursion): the library's AMQP message parser does not enforce a maximum nesting depth when deserializing composite types. A specially crafted message carrying excessively nested AMQP type structures drives the parser into unbounded recursive descent, consuming JVM call stack frames until the runtime throws a StackOverflowError, terminating or degrading the hosting process. The affected CPE (cpe:2.3:a:apache_software_foundation:apache_qpid_proton-j:*:*:*:*:*:*:*:*) covers all releases through 0.34.1 inclusive. The fix in 0.35.0 introduces nesting depth enforcement at the parser layer.

RemediationAI

Upgrade Apache Qpid Proton-J to version 0.35.0, which resolves the uncontrolled recursion flaw by enforcing nesting depth limits during AMQP message parsing. The authoritative vendor advisory is at https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h. If an immediate upgrade is not feasible, restrict AMQP listener access (typically TCP port 5672 or 5671 for TLS) to trusted internal network segments or authenticated clients using network ACLs or firewall rules; this reduces the attack surface without eliminating the vulnerability and may impact legitimate messaging consumers that currently rely on unauthenticated access. Deploying an AMQP-aware proxy or message broker in front of the affected component to validate or reject malformed message structures is a more targeted compensating control but requires protocol-level inspection capability that generic TCP firewalls cannot provide. No workaround fully substitutes for the patch.