What is the CVSS score of CVE-2026-67588?

CVE-2026-67588 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid ProtonJ2 are affected by CVE-2026-67588?

Apache Qpid ProtonJ2 versions through 1.1.0 contain a denial-of-service vulnerability enabling unauthenticated attackers to disrupt message broker operations and dependent business processes from any…

How to fix or mitigate CVE-2026-67588?

Within 24 hours, identify all Apache Qpid ProtonJ2 deployments running versions through 1.1.0 and assess network exposure, prioritizing internet-facing and untrusted-network-adjacent brokers. Within 7 days, deploy network segmentation using firewall rules to restrict broker access from untrusted sources, implement rate limiting and connection throttling on AMQP listening ports, and activate monitoring and alerting for abnormal memory or CPU consumption that may indicate exploitation attempts. Within 30 days, contact the Apache Foundation for patch availability and timeline guidance, evaluate alternative message brokers if the patch timeline is unacceptable to your business, and establish a controlled upgrade strategy once vendor patches become available; document all systems and deployed mitigations in your asset inventory pending final resolution.

Apache Qpid ProtonJ2 CVE-2026-67588

EUVD-2026-53054 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04

GHSA-mxmv-xrrq-hrv5

Apache Denial Of Service Qpid Protonj2 Red Hat

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-authentication network attack requiring no privileges or interaction; impact is availability-only through resource exhaustion, with no data exposure or integrity change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 14:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 14:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 04, 2026 - 20:22 vuln.today

CVE Published

Aug 04, 2026 - 19:20 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values during pre-authentication message processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, and the attack can be executed at low complexity from any network-accessible position. No public exploit or CISA KEV listing exists at time of analysis, though the trivial exploitation conditions make this a realistic threat against any Qpid ProtonJ2 endpoint exposed to untrusted networks.

Technical ContextAI

Apache Qpid ProtonJ2 is the Java implementation of the AMQP 1.0 protocol, part of the broader Apache Qpid messaging project and used in brokers and clients built on AMQP. In AMQP, 'symbols' are interned string identifiers used extensively in protocol framing for field names, descriptor keys, and capability negotiation. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the library caches symbol values encountered during protocol parsing without imposing any bound on cache size or implementing eviction. An attacker can exploit this during the pre-authentication phase by repeatedly sending AMQP frames containing large quantities of novel symbol strings, driving unbounded JVM heap growth. Once memory is exhausted, the process experiences severe garbage collection pressure or an OutOfMemoryError, rendering the service unavailable. Affected versions span all releases up to and including 1.1.0, per EUVD-2026-53054 and NVD.

RemediationAI

Upgrade Apache Qpid ProtonJ2 to version 1.2.0, which resolves the unbounded symbol caching behavior. The fix is confirmed by the Apache vendor advisory published to oss-security (https://seclists.org/oss-sec/2026/q3/427) and the Apache mailing list thread at https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt. If immediate upgrade is not feasible, restrict network access to AMQP listener ports (typically TCP 5672 for plaintext, TCP 5671 for TLS) to known-trusted client IP ranges using firewall or network ACLs - this prevents unauthenticated internet-facing exploitation but does not eliminate the vulnerability for internal threat scenarios. Rate-limiting inbound AMQP connections at the load balancer or broker level can slow attack throughput but will not fully mitigate the root cause. Note that IP-based restrictions may disrupt legitimate distributed consumers if they span multiple network segments.