CVE-2026-67590 in Qpid ProtonJ2
Summary
by MITRE • 08/05/2026
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability described represents a critical pre-authentication denial of service weakness in Apache Qpid ProtonJ2 messaging library that operates at the protocol level. This flaw enables remote attackers to exploit type nesting mechanisms within the messaging framework to trigger stack overflow conditions. The vulnerability specifically affects versions through 1.1.0 and demonstrates how improper input validation can lead to system instability and service disruption.
The technical implementation of this vulnerability stems from insufficient bounds checking during message processing when handling nested type structures. When an attacker crafts maliciously constructed messages containing deeply nested types, the ProtonJ2 library recursively processes these structures without adequate stack depth limitations. This recursive processing eventually exhausts the available stack space, resulting in a StackOverflowError that terminates the application process. The vulnerability operates entirely before authentication, making it particularly dangerous as it requires no valid credentials to exploit.
From an operational perspective, this vulnerability presents a significant risk to messaging infrastructure that relies on Apache Qpid ProtonJ2 for communication. Systems using affected versions could experience complete service disruption when processing maliciously crafted messages, potentially affecting critical business operations and data flow. The impact extends beyond simple denial of service as it can affect multiple concurrent connections and may require system restarts to recover fully. Organizations utilizing this library in production environments face potential downtime and service degradation risks that could impact downstream applications and users.
The vulnerability aligns with CWE-674, which describes "Uncontrolled Recursion" and falls under the broader category of stack overflow conditions that are frequently exploited in denial of service attacks. This weakness maps to ATT&CK technique T1499.004, specifically "Toggle Service State," where attackers can disrupt services by leveraging system resource exhaustion through recursive processing patterns. The attack vector operates at the application layer and requires minimal privileges due to its pre-authentication nature.
Mitigation strategies should prioritize immediate upgrade to version 1.2.0 or later, which includes proper recursion depth limiting and enhanced input validation mechanisms. Organizations should also implement message filtering and rate limiting at network boundaries to reduce exposure while awaiting patch deployment. Additional defensive measures include monitoring for unusual stack usage patterns and implementing circuit breaker patterns to prevent cascading failures when malformed messages are processed. Security teams should conduct thorough testing of patched versions in staging environments before production deployment to ensure compatibility with existing messaging workflows.