EUVD-2026-53035
GHSA-w6q2-5crf-rf8x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-auth network exploitation with no complexity or interaction barriers; impact is availability-only, consistent with controlled memory exhaustion causing DoS.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Remote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exhaust server memory by sending AMQP messages with maliciously crafted type size or count fields, triggering uncontrolled allocation. The vulnerability (CWE-789) requires no authentication or user interaction and is exploitable directly over the network with low complexity, making it trivially reachable in any exposed deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions required for network reachability - exploitation targets the AMQP protocol parsing layer prior to any authentication exchange, meaning any host capable of establishing a TCP connection to the ProtonJ2 listener can trigger the vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects network-accessible, unauthenticated exploitation with high availability impact and no confidentiality or integrity exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 1.2.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Apache Qpid ProtonJ2 and identify instances at version 1.1.0 or earlier; implement network-level access controls restricting AMQP port access if immediate patching cannot be completed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Qpid Protonj2
View allDenial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a remote unauthenticated attacker to crash the me
Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resour
Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cau
Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated at
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today