EUVD-2026-53085
GHSA-hgf5-hpf4-qmrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable pre-auth parse path with no complexity barrier; impact is strictly availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a remote unauthenticated attacker to crash the messaging service by sending AMQP messages with maliciously crafted type nesting that triggers an uncontrolled recursive call stack, resulting in a StackOverflowError. The flaw (CWE-674) is exploitable without authentication over the network with low attack complexity, making it trivially reachable against any exposed ProtonJ2 endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required (PR:N per the supplied CVSS vector), and no special server-side configuration is needed beyond running a network-accessible service that uses Apache Qpid ProtonJ2 ≤ 1.1.0 to parse inbound AMQP messages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (High) is driven by network reachability (AV:N), low complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), and high availability impact (A:H), with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Apache Qpid ProtonJ2 to version 1.2.0, which the Apache project explicitly confirms resolves this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Apache Qpid ProtonJ2 and assess business criticality of each instance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Qpid Protonj2
View allRemote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exha
Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resour
Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cau
Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated at
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today