CVE-2026-67591 in Qpid ProtonJ2
Summary
by MITRE • 08/05/2026
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
Apache Qpid ProtonJ2 is a Java messaging library that implements the AMQP protocol for reliable message delivery in distributed systems. The vulnerability under discussion represents a critical flaw in the library's session flow control mechanism that can be exploited by authenticated attackers to disrupt service availability. This issue specifically impacts versions through 1.1.0 and affects the library's ability to properly manage incoming data flow windows during message transmission sessions.
The technical flaw manifests when an authenticated attacker manipulates session flow control parameters to exceed the configured incoming window limits. This allows the attacker to overwhelm the receiving end of the communication channel by sending more data than the system is prepared to handle, effectively exhausting available resources and preventing legitimate operations from proceeding normally. The vulnerability stems from insufficient validation of flow control parameters during session establishment and data transfer phases, creating an opportunity for resource exhaustion attacks.
The operational impact of this vulnerability extends beyond simple denial of service conditions, as it can be leveraged to disrupt critical messaging infrastructure that depends on Apache Qpid ProtonJ2 for reliable communication. Systems utilizing this library for message queuing, event streaming, or distributed application communication may experience complete service interruption when exploited, potentially affecting business continuity and data processing workflows. The authenticated nature of the attack means that only users with valid credentials can exploit this vulnerability, but it still represents a significant risk to systems where access controls are insufficient or compromised.
This vulnerability aligns with CWE-400, which addresses "Uncontrolled Resource Consumption," and relates to ATT&CK technique T1499.004, "Network Denial of Service," through the exploitation of protocol implementation flaws to exhaust system resources. The flaw demonstrates poor input validation and resource management practices within the flow control subsystem of the messaging library.
Organizations using affected versions of Apache Qpid ProtonJ2 should immediately implement the recommended upgrade to version 1.2.0, which includes patches addressing the flow control window validation issues. Additionally, security teams should monitor for potential exploitation attempts through network traffic analysis and implement appropriate access controls to limit exposure from unauthorized users. The fix incorporates enhanced parameter validation and proper resource management to prevent attackers from manipulating session flow control mechanisms beyond acceptable limits.