What is the CVSS score of CVE-2026-67592?

CVE-2026-67592 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid ProtonJ2 are affected by CVE-2026-67592?

Apache Qpid ProtonJ2 through version 1.1.0 is vulnerable to authenticated denial-of-service attacks that exhaust JVM heap memory and cause application crashes, directly threatening the availability…

How to fix or mitigate CVE-2026-67592?

Within 24 hours, inventory all systems running Apache Qpid ProtonJ2 through version 1.1.0 and map dependencies to understand exposure scope. Within 7 days, stage ProtonJ2 version 1.2.0 in a test environment to validate compatibility with dependent applications and communication platforms. Within 30 days, execute production deployment of version 1.2.0 across all systems, prioritizing critical messaging and event-driven infrastructure.

Apache Qpid ProtonJ2 CVE-2026-67592

EUVD-2026-53096 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-04

GHSA-4gqp-3m3h-rrx3

Denial Of Service Apache Red Hat Qpid Protonj2

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable AMQP endpoint (AV:N), no special conditions beyond authentication (AC:L), valid AMQP credentials required (PR:L), availability-only DoS impact (A:H), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:20 vuln.today

CVE Published

Aug 04, 2026 - 19:30 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical DoS in Apache Qpid ProtonJ2 via Uncontrolled Resource Consumption - CVE-2026-67592 Aug 05, 2026

AnalysisAI

Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cause denial of service by sending deliveries composed of an unbounded number of transfer frames. Because the library imposed no upper limit on how many AMQP transfer frames could constitute a single incoming delivery, a malicious but authenticated client can force unbounded heap accumulation, leading to excessive memory usage and potential JVM failure. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patch version 1.2.0 is available.

Technical ContextAI

Apache Qpid ProtonJ2 (Maven artifact org.apache.qpid:protonj2) is the pure-Java AMQP 1.0 protocol engine underpinning the Apache Qpid messaging ecosystem. In AMQP 1.0, large message payloads may be fragmented across multiple 'transfer frames' within a single logical delivery. The vulnerability arises because ProtonJ2 lacked any enforcement of an upper bound on the number of transfer frames permitted per incoming delivery. This is a classic allocation-without-limits flaw - analogous to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling) - where the receiving side accumulates frame data in memory indefinitely while awaiting delivery completion. No CWE identifier was formally assigned in the source advisory. The affected artifact coordinates are org.apache.qpid:protonj2 versions through 1.1.0 inclusive; no CPE strings were provided in the source data.

RemediationAI

Upgrade Apache Qpid ProtonJ2 (org.apache.qpid:protonj2) to version 1.2.0, which resolves the vulnerability by enforcing a maximum limit on the number of transfer frames permitted per incoming delivery. This upgrade path is confirmed by the vendor advisory published to the oss-security mailing list (https://seclists.org/oss-sec/2026/q3/431). If immediate upgrade is not feasible, administrators should restrict AMQP endpoint access using network-layer controls - such as firewall rules or broker-level IP allowlists - to limit which authenticated clients can reach the ProtonJ2-backed service; this reduces exposure to malicious insiders or compromised service accounts but does not eliminate the underlying flaw. Broker-level or proxy-level connection rate limiting and message-size throttling may also help cap resource consumption under abuse, though these controls operate at a coarser granularity than the per-delivery frame limit that the fix introduces. No additional workarounds were specified in the vendor advisory.