Qpid Protonj2
Monthly
Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cause denial of service by sending deliveries composed of an unbounded number of transfer frames. Because the library imposed no upper limit on how many AMQP transfer frames could constitute a single incoming delivery, a malicious but authenticated client can force unbounded heap accumulation, leading to excessive memory usage and potential JVM failure. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patch version 1.2.0 is available.
Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated attacker who sends data exceeding the negotiated incoming flow control window, potentially causing denial of service on the receiving side. The AMQP session-level window is a back-pressure mechanism; failure to enforce it can lead to unbounded memory consumption or processing overload in the message broker or client. No public exploit code and no CISA KEV listing have been identified at time of analysis. The vendor-released fix is version 1.2.0.
Denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a remote unauthenticated attacker to crash the messaging service by sending AMQP messages with maliciously crafted type nesting that triggers an uncontrolled recursive call stack, resulting in a StackOverflowError. The flaw (CWE-674) is exploitable without authentication over the network with low attack complexity, making it trivially reachable against any exposed ProtonJ2 endpoint. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.21% (11th percentile), suggesting minimal observed exploitation activity at time of analysis despite the ease of triggering the condition.
Remote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exhaust server memory by sending AMQP messages with maliciously crafted type size or count fields, triggering uncontrolled allocation. The vulnerability (CWE-789) requires no authentication or user interaction and is exploitable directly over the network with low complexity, making it trivially reachable in any exposed deployment. No active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.21% (11th percentile) suggests limited real-world exploitation interest at time of analysis; a vendor-released fix is available in version 1.2.0.
Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values during pre-authentication message processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, and the attack can be executed at low complexity from any network-accessible position. No public exploit or CISA KEV listing exists at time of analysis, though the trivial exploitation conditions make this a realistic threat against any Qpid ProtonJ2 endpoint exposed to untrusted networks.
Uncontrolled resource consumption in Apache Qpid ProtonJ2 through version 1.1.0 allows authenticated AMQP clients to cause denial of service by sending deliveries composed of an unbounded number of transfer frames. Because the library imposed no upper limit on how many AMQP transfer frames could constitute a single incoming delivery, a malicious but authenticated client can force unbounded heap accumulation, leading to excessive memory usage and potential JVM failure. No public exploit code and no active exploitation have been identified at time of analysis; vendor-released patch version 1.2.0 is available.
Session flow control enforcement in Apache Qpid ProtonJ2 (versions through 1.1.0) can be bypassed by an authenticated attacker who sends data exceeding the negotiated incoming flow control window, potentially causing denial of service on the receiving side. The AMQP session-level window is a back-pressure mechanism; failure to enforce it can lead to unbounded memory consumption or processing overload in the message broker or client. No public exploit code and no CISA KEV listing have been identified at time of analysis. The vendor-released fix is version 1.2.0.
Denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a remote unauthenticated attacker to crash the messaging service by sending AMQP messages with maliciously crafted type nesting that triggers an uncontrolled recursive call stack, resulting in a StackOverflowError. The flaw (CWE-674) is exploitable without authentication over the network with low attack complexity, making it trivially reachable against any exposed ProtonJ2 endpoint. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.21% (11th percentile), suggesting minimal observed exploitation activity at time of analysis despite the ease of triggering the condition.
Remote unauthenticated denial of service in Apache Qpid ProtonJ2 through version 1.1.0 allows a network attacker to exhaust server memory by sending AMQP messages with maliciously crafted type size or count fields, triggering uncontrolled allocation. The vulnerability (CWE-789) requires no authentication or user interaction and is exploitable directly over the network with low complexity, making it trivially reachable in any exposed deployment. No active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.21% (11th percentile) suggests limited real-world exploitation interest at time of analysis; a vendor-released fix is available in version 1.2.0.
Denial of service in Apache Qpid ProtonJ2 through 1.1.0 allows unauthenticated remote attackers to exhaust server resources by exploiting unbounded caching of AMQP symbol values during pre-authentication message processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, and the attack can be executed at low complexity from any network-accessible position. No public exploit or CISA KEV listing exists at time of analysis, though the trivial exploitation conditions make this a realistic threat against any Qpid ProtonJ2 endpoint exposed to untrusted networks.