EUVD-2026-53085
GHSA-hgf5-hpf4-qmrr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable pre-auth parse path with no complexity barrier; impact is strictly availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a remote unauthenticated attacker to crash the messaging service by sending AMQP messages with maliciously crafted type nesting that triggers an uncontrolled recursive call stack, resulting in a StackOverflowError. The flaw (CWE-674) is exploitable without authentication over the network with low attack complexity, making it trivially reachable against any exposed ProtonJ2 endpoint. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.21% (11th percentile), suggesting minimal observed exploitation activity at time of analysis despite the ease of triggering the condition.
Technical ContextAI
Apache Qpid ProtonJ2 is the Apache Qpid project's pure-Java implementation of the AMQP 1.0 messaging protocol, used as a client library and protocol engine for interacting with AMQP brokers such as Apache ActiveMQ Artemis and Qpid Broker-J. CWE-674 (Uncontrolled Recursion) identifies the root cause: the library's type-decoding logic processes nested AMQP type structures recursively without enforcing a maximum nesting depth. A crafted message containing deeply nested type annotations or composite type wrappers causes the parser to recurse until the JVM thread stack is exhausted, throwing an uncaught StackOverflowError that propagates upward and crashes the affected component. Affected versions are all releases of Apache Qpid ProtonJ2 from inception through 1.1.0 inclusive, per the EUVD entry EUVD-2026-53085 and the Apache OSS Security advisory at https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly.
RemediationAI
The primary fix is to upgrade Apache Qpid ProtonJ2 to version 1.2.0, which the Apache project explicitly confirms resolves this issue. The upgrade advisory is published at https://lists.apache.org/thread/kmov6k7f3moqy01m1s370fl61vgos3ly and corroborated by the oss-security announcement at https://seclists.org/oss-sec/2026/q3/429. For environments where an immediate upgrade is not feasible, a compensating control is to restrict network access to AMQP ports (typically TCP 5671/5672) to trusted sources only using firewall rules or security group policies; this prevents unauthenticated external attackers from reaching the vulnerable parsing path but does not protect against malicious internal actors. Input depth limiting at a reverse proxy or message broker level (if the broker supports maximum-nesting configuration) may reduce exposure but is not a guaranteed workaround as it depends on the broker's enforcement of AMQP framing constraints before forwarding to the ProtonJ2 parser.
More in Qpid Protonj2
View allRemote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exha
Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resour
Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cau
Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated at
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today