CVE-2026-66275 in Qpid Proton-J
Summary
by MITRE • 08/05/2026
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in Apache Qpid Proton-J represents a critical session flow control flaw that enables authenticated attackers to manipulate connection parameters and potentially disrupt service availability. This issue specifically targets the protocol implementation within the Proton-J library, which serves as a foundational component for messaging applications built on the AMQP protocol. The affected version range through 0.34.1 demonstrates that this weakness has persisted across multiple releases, indicating a fundamental design or implementation oversight in how session flow control parameters are managed during message transmission.
The technical flaw manifests when an authenticated user exploits session flow control mechanisms to exceed the designated incoming window limits for message processing. This condition allows attackers to overwhelm connection resources by sending excessive messages beyond normal flow control boundaries, effectively consuming available buffer space and connection capacity. The vulnerability operates at the protocol level where the implementation fails to properly validate or enforce session window constraints during active message transmission, creating a scenario where legitimate connection resources can be exhausted through controlled manipulation of flow control parameters.
From an operational impact perspective, this vulnerability creates significant risk for systems relying on Apache Qpid Proton-J for messaging infrastructure. The potential for denial of service means that authenticated attackers with valid credentials could systematically degrade or completely disrupt message processing capabilities within affected applications. This threat is particularly concerning because it requires only authentication credentials rather than elevated privileges, making it accessible to users who have legitimate access to the messaging system but could abuse their permissions to cause service disruption.
The mitigation strategy involves upgrading to version 0.35.0 which includes fixed implementations of session flow control mechanisms. This upgrade addresses the core issue by implementing proper validation checks for incoming window parameters and ensuring that flow control limits are enforced consistently throughout connection lifecycle management. Organizations should prioritize this patch deployment as it resolves a fundamental security weakness that could be exploited to cause significant operational disruption.
This vulnerability aligns with CWE-129 which describes improper validation of input boundaries, specifically within the context of network protocol implementations. The flaw also maps to ATT&CK technique T1499.004 which covers network denial of service attacks through resource exhaustion, demonstrating how this particular weakness enables attackers to consume system resources and create availability issues. The authentication requirement suggests potential mapping to privilege escalation techniques within the broader attack surface, though the primary impact remains focused on resource exhaustion rather than direct access bypass mechanisms.
Organizations should implement comprehensive monitoring for unusual flow control behavior or connection resource consumption patterns following the upgrade to ensure that the fix is properly implemented and that no residual vulnerabilities exist. The remediation process should include testing of message flow control under various load conditions to verify that the fixed implementation correctly maintains session boundaries and prevents unauthorized resource exhaustion attacks.