Qpid Proton J
Monthly
Excessive heap allocation in Apache Qpid Proton-J's AMQP type parser exposes any network-accessible AMQP endpoint to unauthenticated denial-of-service before an authentication handshake completes. Malformed AMQP frames containing attacker-controlled size or count field values cause the Java library to allocate unbounded memory, leading to JVM heap exhaustion and service crash. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the pre-authentication attack vector and zero-privilege requirement make this a high-priority patch target for any internet-exposed Proton-J deployment.
Resource exhaustion leading to denial of service in Apache Qpid Proton-J through 0.34.1 can be triggered by a pre-authentication attacker via unbounded AMQP symbol value caching. Any unauthenticated network peer capable of establishing an AMQP connection can send crafted frames that cause the library to cache symbol values without bound, consuming memory until the hosting process becomes unavailable. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Excessive heap allocation in Apache Qpid Proton-J's AMQP type parser exposes any network-accessible AMQP endpoint to unauthenticated denial-of-service before an authentication handshake completes. Malformed AMQP frames containing attacker-controlled size or count field values cause the Java library to allocate unbounded memory, leading to JVM heap exhaustion and service crash. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the pre-authentication attack vector and zero-privilege requirement make this a high-priority patch target for any internet-exposed Proton-J deployment.
Resource exhaustion leading to denial of service in Apache Qpid Proton-J through 0.34.1 can be triggered by a pre-authentication attacker via unbounded AMQP symbol value caching. Any unauthenticated network peer capable of establishing an AMQP connection can send crafted frames that cause the library to cache symbol values without bound, consuming memory until the hosting process becomes unavailable. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.