What is the CVSS score of CVE-2026-66276?

CVE-2026-66276 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Proton-J are affected by CVE-2026-66276?

Apache Qpid Proton-J versions through 0.34.1 contain a denial-of-service vulnerability that allows attackers to exhaust server CPU resources through malformed AMQP disposition frames, disrupting…

How to fix or mitigate CVE-2026-66276?

Within 24 hours, identify all systems running Apache Qpid Proton-J version 0.34.1 or earlier and assess exposure to this vulnerability. Within 7 days, plan and prepare the upgrade to version 0.35.0 across all affected systems. Within 30 days, complete the full upgrade to version 0.35.0, prioritizing production message brokers, and validate AMQP connectivity and performance post-upgrade.

Apache Qpid Proton-J CVE-2026-66276

EUVD-2026-53090 MEDIUM

Unchecked Input for Loop Condition (CWE-606)

2026-08-05 apache

GHSA-jx9q-477g-4wgw

Denial Of Service Apache Red Hat Apache Qpid Proton J Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable AMQP protocol requires authenticated session (PR:L); impact is CPU exhaustion with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 07:02 vuln.today

CVE Published

Aug 05, 2026 - 05:39 cve.org

HIGH

DescriptionCVE.org

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

AnalysisAI

Denial of service in Apache Qpid Proton-J through 0.34.1 allows authenticated AMQP clients to exhaust server CPU by sending a crafted disposition frame carrying large or illegal delivery ranges. The library's naive range handling iterates without bounds validation, causing unbounded CPU consumption that can starve legitimate connections. No public exploit identified at time of analysis; vendor-released fix is available in version 0.35.0.

Technical ContextAI

Apache Qpid Proton-J is a Java implementation of the AMQP 1.0 (Advanced Message Queuing Protocol) messaging protocol, used as a client and server messaging library for enterprise messaging systems. In AMQP 1.0, a disposition frame is a protocol-level construct used to settle message deliveries and carries delivery tag ranges indicating which messages are being acknowledged or rejected. CWE-606 (Unchecked Input for Loop Condition) identifies the root cause: the library uses attacker-controlled range values directly as loop bounds without validating that they fall within legal limits, allowing arbitrarily large or malformed ranges to drive the iteration. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_qpid_proton-j:*:*:*:*:*:*:*:*, covering all releases through 0.34.1.

RemediationAI

Vendor-released patch: version 0.35.0 of Apache Qpid Proton-J, confirmed by the Apache advisory at https://lists.apache.org/thread/14nj0lpsqpnd3q0hw0t0tw44qvdo1jc2. If an immediate upgrade to 0.35.0 is not feasible, restrict AMQP endpoint access exclusively to fully trusted, internally controlled clients, as this eliminates the risk from malicious session participants; the trade-off is reduced connectivity for external or partner clients. Additionally, deploying CPU-based rate limiting or connection throttling at the broker or network perimeter can blunt the denial-of-service impact of repeated attacks, though this does not eliminate the underlying flaw. Monitoring for abnormal sustained CPU usage in AMQP broker processes provides a detection signal for active exploitation attempts.