EUVD-2026-53086
GHSA-vx3v-mcrw-7985
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable AMQP endpoint, authenticated per description (PR:L), low complexity session frame abuse, availability-only impact with no scope change.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
AnalysisAI
Denial of service in Apache Qpid Proton-J through 0.34.1 allows authenticated remote attackers to render the messaging endpoint unresponsive by deliberately exceeding the AMQP session flow control incoming window, triggering unbounded resource consumption. The root cause is CWE-770 - insufficient throttling of resource allocation - a well-understood class of flaw in protocol session management. No active exploitation has been confirmed and no public exploit code is known at time of analysis; the vendor has released a fix in version 0.35.0.
Technical ContextAI
Apache Qpid Proton-J is the Java implementation of the Apache Qpid Proton AMQP 1.0 protocol library, used to build messaging clients and brokers that interoperate with systems such as Apache ActiveMQ Artemis, Azure Service Bus, and other AMQP-compliant infrastructure. AMQP 1.0 uses a credit-based session flow control mechanism: the 'incoming window' field in session frames governs how many transfer frames a peer may send before credit is replenished. CWE-770 (Allocation of Resources Without Limits or Throttling) describes the root cause: the library fails to enforce an upper bound on the incoming window size an authenticated peer can specify, allowing a malicious client to cause the server to allocate or track excessive session state. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_qpid_proton-j:*:*:*:*:*:*:*:*, covering all releases through 0.34.1.
RemediationAI
Upgrade Apache Qpid Proton-J to version 0.35.0, which is the vendor-confirmed fix as documented in the Apache advisory at https://lists.apache.org/thread/jds59nxrgcxtlx7xl0kvl5hqt07thxzt. If an immediate upgrade is not feasible, restrict AMQP endpoint access exclusively to fully trusted, internally controlled clients, eliminating the risk of malicious flow control manipulation - note this may require firewall or ACL changes at the network layer and could impact legitimate external integrations. Additionally, applying connection rate-limiting or maximum session counts at the broker or load balancer level can reduce the blast radius of a resource exhaustion attempt, though these do not address the underlying lack of window size enforcement. Both workarounds are temporary mitigations and should not replace patching to 0.35.0.
More in Apache Qpid Proton J
View allDenial of service in Apache Qpid Proton-J through 0.34.1 allows unauthenticated remote attackers to crash the service by
Resource exhaustion in Apache Qpid Proton-J through 0.34.1 allows authenticated AMQP clients to trigger unbounded server
Denial of service in Apache Qpid Proton-J through 0.34.1 allows authenticated AMQP clients to exhaust server CPU by send
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today