What is the CVSS score of CVE-2026-66277?

CVE-2026-66277 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Proton-J are affected by CVE-2026-66277?

Apache Qpid Proton-J through version 0.34.1 contains a resource exhaustion vulnerability (CWE-770) that allows authenticated AMQP clients to trigger unbounded server-side consumption, causing denial…

How to fix or mitigate CVE-2026-66277?

Within 24 hours, conduct a complete inventory of systems running Apache Qpid Proton-J through version 0.34.1 and map exposure to untrusted AMQP client connections. Within 7 days, implement network-level access controls restricting AMQP connectivity to authorized, authenticated peers only, and enable per-connection resource quotas and transfer frame limits on your AMQP broker platform. Within 30 days, subscribe to Apache Qpid security advisories and establish an upgrade plan to version 0.34.2 or later once released; if vendor patch timeline exceeds organizational risk tolerance, evaluate alternative AMQP client libraries and plan a migration if feasible.

Apache Qpid Proton-J CVE-2026-66277

EUVD-2026-53093 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-05 apache

GHSA-p3qq-8qj5-5243

Denial Of Service Apache Red Hat Apache Qpid Proton J Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AMQP is network-delivered (AV:N), exploitable with low complexity once authenticated (AC:L/PR:L), with only availability impacted via resource exhaustion (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 07:02 vuln.today

CVE Published

Aug 05, 2026 - 05:42 cve.org

HIGH

DescriptionCVE.org

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

AnalysisAI

Resource exhaustion in Apache Qpid Proton-J through 0.34.1 allows authenticated AMQP clients to trigger unbounded server-side resource consumption by sending a delivery composed of an arbitrarily large number of transfer frames - a limit the library fails to enforce. The root cause (CWE-770) is an absent cap on per-delivery transfer frame counts during message ingestion, not a memory corruption or code execution class flaw. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the primary risk is targeted denial of service against messaging infrastructure by any authenticated AMQP peer.

Technical ContextAI

Apache Qpid Proton-J is the Java implementation of the AMQP 1.0 protocol (Advanced Message Queuing Protocol), maintained by the Apache Software Foundation. In AMQP 1.0, large messages are legitimately fragmented across multiple 'transfer frames' within a single delivery session. The affected CPE cpe:2.3:a:apache_software_foundation:apache_qpid_proton-j:*:*:*:*:*:*:*:* covers all releases through 0.34.1. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the library's delivery ingestion path allocated state for each incoming transfer frame without enforcing any maximum count, allowing an adversarial sender to drive unbounded memory or processing consumption on the receiving endpoint simply by prolonging a single delivery with an ever-growing frame sequence.

RemediationAI

The primary fix is to upgrade Apache Qpid Proton-J to version 0.35.0, which resolves the issue per the vendor advisory at https://lists.apache.org/thread/48tflr3sx0sxq9bcdy5rh06oy3gmwx02. Vendor-released patch: 0.35.0. If an immediate upgrade is not feasible, consider restricting AMQP endpoint access to a strictly controlled set of trusted authenticated identities, reducing the probability that a malicious peer can reach the vulnerable ingestion path. Network-level rate limiting on AMQP connection throughput or frame volume may partially constrain exploitation but will not eliminate it and may affect legitimate high-throughput workloads. There are no other documented workarounds in the available references; upgrade to 0.35.0 is the only confirmed remediation.