EUVD-2026-53092
GHSA-rvfm-5258-v4xj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-delivered AMQP frame requires authenticated peer (PR:L); only availability is impacted via CPU exhaustion, no confidentiality or integrity loss.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources on the target host by sending a crafted disposition frame containing large or illegal delivery ranges. The library's naive range-iteration logic processes these unbounded ranges without safeguards, causing the consuming thread to spin and starve legitimate message processing. Vendor-released patch version 1.1.0 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Apache Qpid Proton-Dotnet is the official .NET client library for the AMQP 1.0 messaging protocol, part of the Apache Qpid project. In AMQP 1.0, a disposition frame is a transport-layer performative used to settle (acknowledge or reject) batches of message deliveries, identified by a delivery range (first-last delivery ID). The vulnerability stems from naive range handling: the library iterates over the full span of delivery IDs specified in the frame without validating that the range is bounded or legal, allowing a malicious peer to supply an astronomically large or otherwise invalid range (e.g., wrapping values, reversed bounds) to trigger O(n) or unbounded CPU consumption. CWE data was not provided by NVD at time of analysis, but the root cause class maps closely to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). The affected CPE is inferred as cpe:2.3:a:apache:qpid_proton-dotnet:*:*:*:*:*:*:*:* through version 1.0.0.
RemediationAI
The primary fix is to upgrade Apache Qpid Proton-Dotnet to version 1.1.0, which the Apache project confirms resolves the unbounded disposition range handling. The NuGet package should be updated accordingly. The vendor advisory is available at https://qpid.apache.org/ and the oss-security posting at https://seclists.org/oss-sec/2026/q3/425. If immediate upgrade is not feasible, a compensating control is to restrict which AMQP peers are permitted to connect to Qpid Proton-Dotnet consumers - for example, by enforcing SASL authentication with strong credentials and network-layer ACLs (broker-side allow-lists or firewall rules) to ensure only fully trusted clients can send disposition frames. This trade-off reduces attacker surface but does not eliminate the vulnerability in the library itself. Rate-limiting or connection throttling at the broker layer may also reduce impact but will not prevent a persistent authenticated peer from triggering CPU exhaustion.
More in Qpid Proton Dotnet
View allExcessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated at
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash th
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trig
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated atta
Same weakness CWE-606 – Unchecked Input for Loop Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today