Qpid Proton Dotnet
Monthly
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash the AMQP service by submitting messages with deeply nested type structures, triggering a StackOverflowError. The CVSS 7.5 (High) reflects a fully network-exposed, unauthenticated attack path with complete availability impact. No active exploitation has been confirmed (EPSS: 0.19%, 9th percentile; no CISA KEV listing), and the vendor has released a direct fix in version 1.1.0.
Excessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via crafted AMQP messages. The .NET AMQP client library fails to properly validate type size or count fields during message parsing, allowing a remote unauthenticated attacker to trigger unbounded memory allocation and exhaust available resources. No public exploit code has been identified at time of analysis, but the pre-authentication vector and network reachability of AMQP services make this a realistic threat to messaging infrastructure.
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values. Because the vulnerability is reachable before any authentication handshake completes, no credentials or prior access are required to trigger resource exhaustion. No public exploit or KEV listing is identified at time of analysis, but the pre-auth nature and low attack complexity make this a meaningful availability risk for any internet- or network-exposed AMQP endpoint using the affected .NET library.
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trigger denial of service by sending a single delivery split across an unbounded number of transfer frames. The .NET implementation of the AMQP 1.0 toolkit lacked any enforced ceiling on incoming transfer frames per delivery, meaning a malicious but authenticated peer can exhaust receiver memory or CPU without restriction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in version 1.1.0.
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources on the target host by sending a crafted disposition frame containing large or illegal delivery ranges. The library's naive range-iteration logic processes these unbounded ranges without safeguards, causing the consuming thread to spin and starve legitimate message processing. Vendor-released patch version 1.1.0 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated attacker to deliberately exceed the AMQP incoming session flow control window, potentially causing denial of service on affected messaging endpoints. The vulnerability is rated 'important' by Apache and affects the .NET client library for AMQP-based messaging infrastructure. No public exploit code or active exploitation has been identified; vendor-confirmed fix is available in version 1.1.0.
Denial of service in Apache Qpid Proton-Dotnet 1.0.0 and earlier allows a pre-authentication remote attacker to crash the AMQP service by submitting messages with deeply nested type structures, triggering a StackOverflowError. The CVSS 7.5 (High) reflects a fully network-exposed, unauthenticated attack path with complete availability impact. No active exploitation has been confirmed (EPSS: 0.19%, 9th percentile; no CISA KEV listing), and the vendor has released a direct fix in version 1.1.0.
Excessive memory allocation in Apache Qpid Proton Dotnet through 1.0.0 enables pre-authentication denial of service via crafted AMQP messages. The .NET AMQP client library fails to properly validate type size or count fields during message parsing, allowing a remote unauthenticated attacker to trigger unbounded memory allocation and exhaust available resources. No public exploit code has been identified at time of analysis, but the pre-authentication vector and network reachability of AMQP services make this a realistic threat to messaging infrastructure.
Pre-authentication denial of service in Apache Qpid Proton-Dotnet through version 1.0.0 allows remote unauthenticated attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values. Because the vulnerability is reachable before any authentication handshake completes, no credentials or prior access are required to trigger resource exhaustion. No public exploit or KEV listing is identified at time of analysis, but the pre-auth nature and low attack complexity make this a meaningful availability risk for any internet- or network-exposed AMQP endpoint using the affected .NET library.
Uncontrolled resource consumption in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP client to trigger denial of service by sending a single delivery split across an unbounded number of transfer frames. The .NET implementation of the AMQP 1.0 toolkit lacked any enforced ceiling on incoming transfer frames per delivery, meaning a malicious but authenticated peer can exhaust receiver memory or CPU without restriction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the fix is available in version 1.1.0.
Denial of service in Apache Qpid Proton-Dotnet through 1.0.0 allows an authenticated AMQP peer to exhaust CPU resources on the target host by sending a crafted disposition frame containing large or illegal delivery ranges. The library's naive range-iteration logic processes these unbounded ranges without safeguards, causing the consuming thread to spin and starve legitimate message processing. Vendor-released patch version 1.1.0 is available; no public exploit or CISA KEV listing has been identified at time of analysis.
Session flow control enforcement failure in Apache Qpid Proton-Dotnet through version 1.0.0 allows an authenticated attacker to deliberately exceed the AMQP incoming session flow control window, potentially causing denial of service on affected messaging endpoints. The vulnerability is rated 'important' by Apache and affects the .NET client library for AMQP-based messaging infrastructure. No public exploit code or active exploitation has been identified; vendor-confirmed fix is available in version 1.1.0.