CVE-2026-67554
Received Received - Intake

Denial of Service in Apache Qpid Proton-Dotnet

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-67554
EUVD
EUVD-2026-53092

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apache qpid_proton_dotnet to 1.0.0 (inc)
apache qpid_proton_dotnet to 1.1.0 (exc)
apache qpid_proton_dotnet to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated attacker to send a specially crafted disposition frame with large or illegal ranges to an Apache Qpid Proton-Dotnet system. The system's naive handling of these ranges causes excessive CPU usage, leading to a denial of service condition where the system becomes unresponsive or slow.

Detection Guidance

This vulnerability involves excessive CPU usage due to crafted disposition frames. Monitor system CPU usage for unusual spikes. Check logs for repeated or malformed frame handling in Apache Qpid Proton-Dotnet applications.

Impact Analysis

If you use Apache Qpid Proton-Dotnet versions through 1.0.0, an attacker could exploit this flaw to consume excessive CPU resources, causing service disruptions or crashes. This may lead to downtime for applications relying on the library.

Compliance Impact

This vulnerability primarily causes denial of service through excessive CPU usage, which may disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, prolonged downtime could impact availability requirements under these regulations.

Mitigation Strategies

Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 or later to address the issue. Apply patches if available. Restrict access to authenticated users only until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart