What is the CVSS score of CVE-2026-67551?

CVE-2026-67551 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid Proton Dotnet are affected by CVE-2026-67551?

Apache Qpid Proton .NET library through version 1.0.0 is vulnerable to a pre-authentication denial of service attack that allows remote attackers to crash messaging services by exhausting system…

How to fix or mitigate CVE-2026-67551?

Within 24 hours, inventory all systems and applications using Apache Qpid Proton .NET through version 1.0.0, prioritizing production messaging services and documenting their criticality and network accessibility. Within 7 days, implement compensating controls: restrict AMQP service network access to explicitly trusted clients only via firewall or network segmentation policies, enable application-level connection authentication and message rate limiting to slow potential memory exhaustion, and deploy real-time memory usage monitoring with alerting thresholds on affected services. Within 30 days, evaluate migration strategies to alternative AMQP libraries (such as AMQP.Net.Lite or RabbitMQ.Client), monitor Apache Qpid project advisories for vendor patch releases, and conduct a full architecture review to determine if persistent use of Qpid Proton .NET aligns with organizational risk tolerance.

Apache Qpid Proton Dotnet CVE-2026-67551

EUVD-2026-53057 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-08-04

GHSA-vgxj-mxxf-j384

Denial Of Service Apache Red Hat Qpid Proton Dotnet

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable pre-authentication exploit with no privileges or user interaction; impact is availability only via resource exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 04, 2026 - 20:26 vuln.today

CVE Published

Aug 04, 2026 - 19:09 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Excessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via crafted AMQP messages. The .NET AMQP client library fails to properly validate type size or count fields during message parsing, allowing a remote unauthenticated attacker to trigger unbounded memory allocation and exhaust available resources. No public exploit code has been identified at time of analysis, but the pre-authentication vector and network reachability of AMQP services make this a realistic threat to messaging infrastructure.

Technical ContextAI

Apache Qpid Proton Dotnet is the official .NET implementation of the Qpid Proton AMQP 1.0 messaging toolkit (org.apache.qpid). AMQP 1.0 encodes typed values with explicit size and count fields in its binary wire format; the vulnerability lies in the library's deserialization or frame-parsing layer, which does not adequately constrain allocations derived from attacker-controlled size or count values before completing authentication. The root cause class is uncontrolled resource consumption - analogous to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling) - though no CWE is formally assigned in the advisory. The affected package covers all releases through 1.0.0 of the Dotnet-specific implementation; the sibling C, Java, and Python Proton libraries are not mentioned as affected.

RemediationAI

Upgrade Apache Qpid Proton Dotnet to version 1.1.0, which the vendor confirms resolves this issue; this is the primary and recommended fix. The advisory was published via oss-security (https://seclists.org/oss-sec/2026/q3/422) and the Apache Qpid project site (https://qpid.apache.org/). If an immediate upgrade is not feasible, compensating controls should focus on restricting network access to AMQP listener ports (default TCP 5672 and TLS 5671) to known, trusted clients via firewall rules or network segmentation, thereby removing the unauthenticated remote attack surface. Enforcing mutual TLS authentication at the network or load-balancer layer before AMQP frames reach the application is a stronger compensating control, though it introduces certificate management overhead. Rate-limiting new AMQP connections per source IP at the perimeter can reduce the impact of allocation exhaustion attempts but does not eliminate the vulnerability.