CVE-2026-67589

Analyzed Analyzed - Analysis Complete

Denial of Service in Apache Qpid ProtonJ2

Publication date: 2026-08-05

Last updated on: 2026-08-07

Assigner: Apache Software Foundation

Description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-07

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-67589

EUVD

EUVD-2026-53035

Affected Vendors & Products

Vendor	Product	Version / Range
apache	qpid_protonj2	to 1.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to cause a denial of service by exploiting improper handling of type size and count in Apache Qpid ProtonJ2 versions before 1.2.0. The attacker can trigger excessive memory allocation without authentication.

Detection Guidance

This vulnerability is specific to Apache Qpid ProtonJ2 versions before 1.2.0. Detection involves checking the installed version of Qpid ProtonJ2 on your system. Use commands like 'qpid-protonj2 --version' or inspect package managers (e.g., 'dpkg -l | grep qpid-protonj2' for Debian/Ubuntu). If the version is below 1.2.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to crash systems running vulnerable versions of Apache Qpid ProtonJ2, leading to service disruption. Systems using affected versions are at risk of unavailability.

Compliance Impact

This vulnerability is a denial of service issue caused by excessive allocation due to improper type size handling. It does not directly affect data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. Compliance impact would be indirect if the DoS disrupts services handling regulated data.

Mitigation Strategies

Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-67589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70