What is the CVSS score of CVE-2026-67591?

CVE-2026-67591 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid ProtonJ2 are affected by CVE-2026-67591?

Apache Qpid ProtonJ2 versions through 1.1.0 contain a critical vulnerability affecting organizations whose message brokers or client systems depend on AMQP messaging.

How to fix or mitigate CVE-2026-67591?

Within 24 hours: conduct inventory of all systems running Apache Qpid ProtonJ2 through version 1.1.0 and document their criticality and network context. Within 7 days: complete testing of upgrade to version 1.2.0 in staging environments and coordinate with application owners to schedule deployment windows. Within 30 days: deploy version 1.2.0 across all production systems running affected versions, prioritizing critical infrastructure and message brokers.

Apache Qpid ProtonJ2 CVE-2026-67591

EUVD-2026-53089 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04

GHSA-xcxh-hgpq-crj6

Denial Of Service Apache Red Hat Qpid Protonj2

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable AMQP endpoint, authentication required (PR:L), availability-only impact via resource exhaustion, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 04, 2026 - 20:20 vuln.today

CVE Published

Aug 04, 2026 - 19:27 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated attacker who sends data exceeding the negotiated incoming flow control window, potentially causing denial of service on the receiving side. The AMQP session-level window is a back-pressure mechanism; failure to enforce it can lead to unbounded memory consumption or processing overload in the message broker or client. No public exploit code and no CISA KEV listing have been identified at time of analysis. The vendor-released fix is version 1.2.0.

Technical ContextAI

Apache Qpid ProtonJ2 (Maven artifact org.apache.qpid:protonj2) is the pure-Java implementation of the Apache Qpid Proton AMQP 1.0 messaging toolkit. AMQP 1.0 defines a session-level flow control mechanism using 'incoming-window' frames: each peer advertises how many incoming transfer frames it can accept before requiring acknowledgment. This CVE indicates that ProtonJ2 does not enforce the incoming session window boundary on the receiving side, allowing a peer to transmit more frames than the window permits. This maps conceptually to an improper enforcement of message or data stream limits (analogous to CWE-770 Allocation of Resources Without Limits or CWE-400 Uncontrolled Resource Consumption), though no formal CWE mapping was provided in the advisory. Affected CPE: org.apache.qpid:protonj2 through 1.1.0.

RemediationAI

Upgrade Apache Qpid ProtonJ2 to version 1.2.0, which resolves the flow control enforcement defect per the vendor advisory. The fix version (1.2.0) is confirmed by the Apache advisory on the oss-security mailing list. If an immediate upgrade is not feasible, restrict AMQP session access to fully trusted, authenticated clients only - untrusted or externally-facing AMQP endpoints increase exposure. Additionally, consider enforcing connection-level rate limits or frame-count throttling at the network or broker layer as a compensating control; note that this approach is infrastructure-dependent and does not fix the underlying library defect. No workaround that fully substitutes for the patch has been identified in the advisory. Refer to https://qpid.apache.org/ and https://seclists.org/oss-sec/2026/q3/430 for official guidance.