What is the CVSS score of EUVD-2026-53035?

EUVD-2026-53035 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Qpid ProtonJ2 are affected by EUVD-2026-53035?

Apache Qpid ProtonJ2 versions up to 1.1.0 contain a remote denial-of-service vulnerability that allows unauthenticated network attackers to crash messaging servers through malformed AMQP messages.

How to fix or mitigate EUVD-2026-53035?

Within 24 hours: Inventory all systems running Apache Qpid ProtonJ2 and identify instances at version 1.1.0 or earlier; implement network-level access controls restricting AMQP port access if immediate patching cannot be completed. Within 7 days: Deploy upgrade to Apache Qpid ProtonJ2 version 1.2.0 or later across all development, staging, and production environments. Within 30 days: Complete patching verification across all infrastructure, validate that messaging services operate normally, and update vulnerability management records to reflect remediation.

Apache Qpid ProtonJ2 EUVD-2026-53035

| CVE-2026-67589 HIGH

Memory Allocation with Excessive Size Value (CWE-789)

2026-08-04

GHSA-w6q2-5crf-rf8x

Apache Denial Of Service Qpid Protonj2 Red Hat

7.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-auth network exploitation with no complexity or interaction barriers; impact is availability-only, consistent with controlled memory exhaustion causing DoS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 22:52 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 06, 2026 - 22:51 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 04, 2026 - 20:22 vuln.today

CVE Published

Aug 04, 2026 - 19:23 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exhaust server memory by sending AMQP messages with maliciously crafted type size or count fields, triggering uncontrolled allocation. The vulnerability (CWE-789) requires no authentication or user interaction and is exploitable directly over the network with low complexity, making it trivially reachable in any exposed deployment. No active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.21% (11th percentile) suggests limited real-world exploitation interest at time of analysis; a vendor-released fix is available in version 1.2.0.

Technical ContextAI

Apache Qpid ProtonJ2 is the Java implementation of the AMQP 1.0 messaging protocol, used to build message brokers and clients in enterprise Java environments. The AMQP protocol encodes messages with typed data descriptors that include size and count fields; CWE-789 (Uncontrolled Memory Allocation) arises when a protocol parser allocates memory directly proportional to attacker-controlled values without first validating upper bounds or enforcing resource quotas. In this case, the ProtonJ2 decoder processes type size or count annotations from incoming wire data and allocates heap memory accordingly, enabling a remote party to force allocations far exceeding available resources. Affected versions are all releases of Apache Qpid ProtonJ2 up to and including 1.1.0, as confirmed by NVD and EUVD-2026-53035.

RemediationAI

Vendor-released patch: version 1.2.0. All users of Apache Qpid ProtonJ2 on version 1.1.0 or earlier should upgrade to 1.2.0 immediately, as documented in the Apache Qpid project advisory at https://qpid.apache.org/ and the oss-security disclosure at https://seclists.org/oss-sec/2026/q3/428. If immediate upgrade is not feasible, compensating controls should include placing the ProtonJ2 endpoint behind a network perimeter that restricts access to known, trusted AMQP clients, effectively converting the AV:N vector into a locally-scoped risk. Additionally, operators may configure resource throttling or connection rate limiting at the load balancer or firewall layer to bound allocation potential, though this does not eliminate the vulnerability and may affect legitimate high-throughput workloads. Monitoring for abnormal memory consumption trends on affected services is advisable as an interim detection measure.