What is the CVSS score of CVE-2026-67553?

CVE-2026-67553 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Qpid Proton-Dotnet are affected by CVE-2026-67553?

Apache Qpid Proton-Dotnet contains a session flow control bypass vulnerability enabling denial-of-service attacks on AMQP messaging endpoints, potentially disrupting critical organization-wide…

How to fix or mitigate CVE-2026-67553?

Within 24 hours: inventory all systems and applications running Apache Qpid Proton-Dotnet versions prior to 1.1.0 and classify affected messaging infrastructure by criticality level. Within 7 days: deploy the vendor-released patch (version 1.1.0) to all non-critical systems and develop a staged rollout plan for critical messaging systems. Within 30 days: complete patch deployment across all affected deployments and validate that session flow control enforcement is functioning correctly.

Qpid Proton-Dotnet CVE-2026-67553

EUVD-2026-53088 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04

GHSA-rxxp-x2qg-g2f2

Apache Denial Of Service Qpid Proton Dotnet

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

AMQP is network-accessible (AV:N), no special conditions beyond auth (AC:L), session credentials required (PR:L), DoS-only impact on the vulnerable system (A:H, C:N, I:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 04, 2026 - 20:25 vuln.today

CVE Published

Aug 04, 2026 - 19:13 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated attacker to deliberately exceed the AMQP incoming session flow control window, potentially causing denial of service on affected messaging endpoints. The vulnerability is rated 'important' by Apache and affects the .NET client library for AMQP-based messaging infrastructure. No public exploit code or active exploitation has been identified; vendor-confirmed fix is available in version 1.1.0.

Technical ContextAI

Apache Qpid Proton-Dotnet is the .NET implementation of the Qpid Proton AMQP messaging toolkit (org.apache.qpid), providing a standards-compliant AMQP 1.0 protocol engine for .NET applications. AMQP defines a session-level credit-based flow control mechanism that limits the number of in-flight message transfers between peers - this window is negotiated at session establishment and is intended to prevent a sender from overwhelming a receiver. This vulnerability represents a failure to properly enforce the incoming session flow control window boundary on the receiving side, allowing a sender to push beyond the agreed limit. The root cause class aligns with improper resource control or improper enforcement of protocol-defined limits (consistent with CWE-400 Uncontrolled Resource Consumption, though no CWE was specified in the input data). Affected CPE data is not formally published in the input, but the impacted artifact is the org.apache.qpid Proton-Dotnet package through version 1.0.0.

RemediationAI

Upgrade Apache Qpid Proton-Dotnet to version 1.1.0, which is confirmed by the vendor advisory to contain the fix (https://seclists.org/oss-sec/2026/q3/424). If immediate upgrade is not feasible, restrict AMQP session access to fully trusted, internally-controlled clients only by enforcing network-level controls (firewall rules, VPC segmentation) to prevent externally-sourced or partially-trusted authenticated peers from reaching the AMQP endpoint - note this may restrict legitimate messaging workflows. No documented workaround that preserves full functionality is available in the referenced sources. Monitor session-level resource consumption as a compensating detection control until the patch is applied.