EUVD-2026-53084
GHSA-qwm2-w9f2-j6cg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-authentication network parsing flaw with no complexity or privilege requirements; only availability is impacted via uncontrolled recursion causing a process crash.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash the AMQP service by submitting messages with deeply nested type structures, triggering a StackOverflowError. The CVSS 7.5 (High) reflects a fully network-exposed, unauthenticated attack path with complete availability impact. No active exploitation has been confirmed (EPSS: 0.19%, 9th percentile; no CISA KEV listing), and the vendor has released a direct fix in version 1.1.0.
Technical ContextAI
Apache Qpid Proton-Dotnet is the .NET implementation of the Apache Qpid Proton AMQP 1.0 protocol engine, used to build messaging clients and brokers that communicate over the AMQP wire format. AMQP 1.0 supports richly nested type descriptors in its encoded messages, and the Proton-Dotnet library must recursively decode these structures. CWE-674 (Uncontrolled Recursion) identifies the root cause: the library lacks a recursion depth bound when parsing nested type annotations, so a malicious sender can craft a message with arbitrarily deep nesting that exhausts the .NET call stack before authentication is enforced. The result is an unhandled StackOverflowError that terminates the hosting process. Affected versions span the entire 0.x through 1.0.0 release history.
RemediationAI
Upgrade Apache Qpid Proton-Dotnet to version 1.1.0, the vendor-released patch that resolves this vulnerability, as documented in the Apache disclosure at https://lists.apache.org/thread/4dyg0gycrv55ox4oywqght61b053g8xj and the oss-security announcement at https://seclists.org/oss-sec/2026/q3/423. If an immediate upgrade is not feasible, apply network-level controls to restrict access to the AMQP listener ports (typically TCP 5671 and 5672) to only trusted, authenticated upstream clients or brokers - this limits pre-authentication exposure but does not remove the vulnerability and depends entirely on perimeter enforcement being comprehensive. An alternative compensating control is to place a protocol-aware proxy or gateway in front of the Proton-Dotnet endpoint that validates or limits message nesting depth before forwarding; this is operationally complex and may not be achievable with off-the-shelf tools. Neither workaround substitutes for patching to version 1.1.0.
More in Qpid Proton Dotnet
View allExcessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated at
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trig
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated atta
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today