EUVD-2026-53053
GHSA-pr7j-v7jr-j955
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable pre-auth path (AV:N/PR:N), no complexity or interaction required; availability-only impact with no scope change.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values. Because the vulnerability is reachable before any authentication handshake completes, no credentials or prior access are required to trigger resource exhaustion. No public exploit or KEV listing is identified at time of analysis, but the pre-auth nature and low attack complexity make this a meaningful availability risk for any internet- or network-exposed AMQP endpoint using the affected .NET library.
Technical ContextAI
Apache Qpid Proton-Dotnet (NuGet package Apache.Qpid.Proton) is the .NET implementation of the Qpid Proton AMQP 1.0 messaging toolkit. AMQP 1.0 uses a symbol type to encode named identifiers (e.g., capability names, descriptor keys) that are transmitted as part of connection and session negotiation frames. The library apparently caches incoming symbol values to avoid repeated string allocation, but the cache has no upper bound on the number of entries or total memory consumed. An attacker can craft AMQP frames containing large volumes of unique or arbitrarily large symbol values, filling the cache unboundedly before authentication is required. No CWE was provided in the advisory, but the root cause maps to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). The affected CPE is cpe:2.3:a:apache:qpid_proton-dotnet:*:*:*:*:*:*:*:* through version 1.0.0.
RemediationAI
Upgrade Apache.Qpid.Proton to version 1.1.0, which the vendor confirms contains the fix for this issue. The upgrade path is straightforward via NuGet package management. If an immediate upgrade is not possible, the primary compensating control is network-layer restriction: place the AMQP service behind a firewall or load balancer that limits connections to known trusted client IPs, reducing exposure to untrusted pre-authentication traffic. Additionally, configuring connection rate limiting or per-source connection caps at the network edge can slow resource exhaustion attempts, though it does not eliminate the vulnerability. Note that these controls do not fix the root cause and trusted-but-compromised clients could still trigger exhaustion. Monitor memory usage on hosts running the affected library. No additional workarounds are documented in the advisory.
More in Qpid Proton Dotnet
View allExcessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash th
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trig
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated atta
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today