CVE-2026-67592 in Qpid ProtonJ2
Summary
by MITRE • 08/05/2026
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability represents a classic resource exhaustion flaw that can lead to denial of service conditions within the Apache Qpid ProtonJ2 messaging library. The issue stems from insufficient validation of transfer frame limits during incoming message deliveries, allowing authenticated attackers to manipulate the protocol flow in ways that consume excessive system resources. The vulnerability specifically impacts versions through 1.1.0 of the ProtonJ2 client library, which is widely used for implementing AMQP 1.0 compliant messaging applications.
The technical root cause involves the lack of proper bounds checking on the maximum number of transfer frames that can be processed within a single incoming delivery operation. Transfer frames are fundamental components of the AMQP protocol that carry message content and metadata between broker and client. When an attacker sends a specially crafted sequence of transfer frames with unusually high frame counts, the library fails to enforce reasonable limits, leading to unbounded memory allocation and processing overhead. This behavior aligns with CWE-770, which categorizes excessive resource consumption vulnerabilities as critical security flaws that can be exploited for denial of service attacks.
The operational impact of this vulnerability extends beyond simple resource exhaustion, as it can effectively瘫痪 messaging services that rely on Qpid ProtonJ2 for their communication infrastructure. Attackers can leverage this weakness to consume CPU cycles, memory, and other system resources at rates that can degrade or completely halt service availability. The authenticated nature of the attack means that adversaries must have valid credentials to exploit the vulnerability, but this requirement does not significantly reduce the risk since compromised accounts are common in production environments. This flaw particularly affects systems where Qpid ProtonJ2 is used as a client library for high-volume messaging applications, making it a significant concern for enterprise messaging infrastructure.
From an ATT&CK framework perspective, this vulnerability maps to techniques involving resource exhaustion and denial of service operations, specifically targeting the availability aspect of the CIA triad. The attack chain typically begins with authentication through valid credentials followed by protocol manipulation that triggers the resource consumption behavior. Organizations using affected versions should immediately implement the recommended upgrade to version 1.2.0, which includes proper frame limit enforcement and validation mechanisms. Additional mitigations may include implementing network-level rate limiting, monitoring for unusual frame count patterns, and establishing automated alerting for resource utilization spikes that could indicate exploitation attempts. The fix addresses the underlying protocol handling by introducing strict bounds checking on transfer frame counts, preventing attackers from manipulating delivery operations to consume excessive system resources.