CVE-2026-67592

HIGH

Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery

Title source: cna
STIX 2.1

Description

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue

References (2)

Core 2

Scores

CVSS v3 7.5
EPSS 0.0033
EPSS Percentile 25.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (1)
Apache Software Foundation/Apache Qpid ProtonJ2 < 1.1.0
Published Aug 05, 2026
Tracked Since Aug 05, 2026