EUVD-2026-53095
GHSA-4cqm-fq4g-r4vq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable AMQP endpoint, low complexity, but PR:L because authenticated session is required; impact is availability-only with no scope change.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trigger denial of service by sending a single delivery split across an unbounded number of transfer frames. The .NET implementation of the AMQP 1.0 toolkit lacked any enforced ceiling on incoming transfer frames per delivery, meaning a malicious but authenticated peer can exhaust receiver memory or CPU without restriction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in version 1.1.0.
Technical ContextAI
Apache Qpid Proton is Apache's low-level AMQP 1.0 messaging toolkit; the Proton-Dotnet variant (org.apache.qpid groupId) is its .NET implementation used to build AMQP producers, consumers, and brokers on the .NET runtime. In AMQP 1.0, a 'delivery' (a logical message) may be segmented across multiple 'transfer frames' at the network level, allowing large messages to be streamed incrementally. The vulnerability arises because the library imposed no maximum on how many transfer frames could compose a single incoming delivery - an unconstrained resource allocation pattern consistent with CWE-770 (Allocation of Resources Without Limits or Throttling). No formal CWE was assigned in the advisory; CWE-400 (Uncontrolled Resource Consumption) is equally applicable. Affected CPE is not formally published in this advisory but corresponds to the Apache Qpid Proton-Dotnet package through version 1.0.0.
RemediationAI
The primary remediation is to upgrade Apache Qpid Proton-Dotnet to version 1.1.0, which introduces the missing transfer-frame limit and resolves the root cause. This is confirmed by the Apache advisory (https://seclists.org/oss-sec/2026/q3/426 and https://qpid.apache.org/). If an immediate upgrade is not possible, compensating controls include restricting which authenticated clients may connect to the AMQP endpoint - reducing the attacker pool to only fully trusted internal services - and configuring an upstream broker or load balancer (e.g., Apache ActiveMQ, RabbitMQ, or a reverse proxy) to enforce per-connection frame-rate limits or maximum message sizes where the protocol layer permits. Additionally, deploying process-level memory limits and watchdog/restart policies on the Proton-Dotnet service can bound the blast radius of a DoS attempt. Note that these workarounds reduce but do not eliminate risk; upgrading to 1.1.0 is the only complete fix.
More in Qpid Proton Dotnet
View allExcessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated at
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash th
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated atta
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today