Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

published 2026-08-05 3 mo ago modified 2026-10-24 16 d ago also EUVD-2026-53096

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits: 0; none known

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid ProtonJ2: through 1.1.0.

Users are recommended to upgrade to version 1.2.0, which fixes the issue

Patch / fix

fixed in 1

apache qpid_protonj2 1.2.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-67592 updated 2026-10-30 cvss 6.5

org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via uncontrolled incoming data transfers

Red Hat AMQ Clients protonj2 1.1.0.redhat-00001
affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 3 mo ago (2026-08-05)

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Apache Software Foundation Apache Qpid ProtonJ2

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

lists.apache.org /thread/b4pv9hfdk7ox78pss77sb4nzwjrvqhhz
vendor-advisory, mailing-list
openwall.com /lists/oss-security/2026/08/04/31
mailing-list, third-party-advisory

Sources

CVE List CVE-2026-67592
NVD CVE-2026-67592

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary