CVE-2026-66276
Received Received - Intake

Denial of Service in Apache Qpid Proton-J

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-66276
EUVD
EUVD-2026-53090

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache qpid_proton-j to 0.34.1 (inc)
apache qpid_proton-j to 0.35.0 (exc)
apache qpid_proton-j to 0.34.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated attacker to send a specially crafted disposition frame with large or illegal range values to Apache Qpid Proton-J versions up to 0.34.1. The system's naive handling of these ranges causes excessive CPU usage, resulting in a denial of service condition.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive CPU usage caused by crafted disposition frames. Check Qpid Proton-J logs for unusual frame handling or CPU spikes during message processing. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to consume excessive CPU resources on the affected system, leading to degraded performance or complete unavailability of services relying on Apache Qpid Proton-J.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt services handling personal or health data. Excessive CPU usage may lead to system unavailability, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade Apache Qpid Proton-J to version 0.35.0 or later to fix the issue. If immediate upgrade is not possible, restrict access to authenticated users only and monitor for abnormal CPU usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart