CVE-2026-66257: Apache Qpid Proton-J DoS Vulnerability

CVE-2026-66257 Overview

CVE-2026-66257 is a denial-of-service vulnerability in Apache Qpid Proton-J, the Java library implementing the AMQP 1.0 protocol. A pre-authentication attacker can exploit unbounded symbol value caching to exhaust server resources. The flaw affects all versions through 0.34.1 and is fixed in 0.35.0. The vulnerability maps to [CWE-770] (Allocation of Resources Without Limits or Throttling) and is exploitable over the network without authentication or user interaction. Successful exploitation degrades or halts messaging services that depend on Qpid Proton-J for AMQP transport.

Critical Impact
Unauthenticated remote attackers can trigger memory exhaustion in Apache Qpid Proton-J deployments, causing service outages across dependent AMQP messaging infrastructure.

Affected Products

Apache Qpid Proton-J through version 0.34.1
Java applications embedding Qpid Proton-J for AMQP 1.0 messaging
Downstream messaging brokers and clients that bundle vulnerable Proton-J releases

Discovery Timeline

2026-08-05 - CVE-2026-66257 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-66257

Vulnerability Analysis

Apache Qpid Proton-J caches AMQP symbol values received on the wire to reduce repeated decoding overhead. The cache has no upper bound on the number of distinct symbols retained. An attacker connecting to an AMQP endpoint can transmit crafted frames containing unique symbol values before completing authentication. Each new symbol allocates memory in the cache and is never evicted.

The attack targets availability only. Confidentiality and integrity are not affected, but memory pressure eventually triggers OutOfMemoryError conditions, garbage collection thrashing, or process termination. Messaging brokers built on Proton-J may drop legitimate connections while under attack.

Root Cause

The root cause is missing enforcement of a maximum size on the symbol value cache. The decoder path treats every distinct symbol as a candidate for long-lived caching without applying a bounded eviction policy such as LRU or a hard ceiling.

Attack Vector

An unauthenticated remote attacker opens an AMQP connection to a service backed by Apache Qpid Proton-J. The attacker sends a stream of AMQP performatives containing unique symbol tokens across the pre-authentication handshake surface. The library caches each symbol, growing heap consumption proportional to attacker input. Repeated or parallel connections accelerate exhaustion.

The vulnerability manifests during AMQP frame decoding before credential validation completes. Refer to the Apache Mailing List Thread and the Openwall OSS Security Notice for the maintainer's disclosure details.

Detection Methods for CVE-2026-66257

Indicators of Compromise

Sustained heap growth in JVM processes hosting Qpid Proton-J without corresponding legitimate traffic increases
Repeated OutOfMemoryError events or garbage collection saturation in AMQP broker logs
High connection rates from single or clustered source IPs targeting AMQP listener ports (typically 5672, 5671)
Abnormal volume of unique symbol values recorded in AMQP protocol traces

Detection Strategies

Inventory all Java applications and brokers that bundle proton-j and verify version strings against 0.35.0
Instrument the JVM with heap and GC telemetry to detect memory growth trends tied to AMQP session activity
Correlate connection counts, source addresses, and heap utilization to identify pre-authentication abuse

Monitoring Recommendations

Alert on JVM heap usage exceeding baseline thresholds for AMQP service processes
Track connection churn and half-open sessions on AMQP listener ports
Log and review protocol decoding errors and frame anomalies emitted by Proton-J

How to Mitigate CVE-2026-66257

Immediate Actions Required

Upgrade Apache Qpid Proton-J to version 0.35.0 or later across all affected deployments
Identify transitive dependencies that pull in vulnerable Proton-J releases through downstream messaging libraries
Restrict network exposure of AMQP endpoints to trusted client ranges until patching completes

Patch Information

Apache released Qpid Proton-J 0.35.0 to fix the unbounded symbol caching behavior. Users on any release through 0.34.1 should upgrade. Verify dependency trees using mvn dependency:tree or equivalent Gradle tooling to confirm the resolved version.

Workarounds

Place AMQP listeners behind network access controls that limit source addresses to authenticated peers
Apply per-source connection rate limits at the load balancer or firewall layer to slow symbol cache growth
Configure JVM memory limits and restart policies to bound the blast radius until the patch is deployed

bash

# Verify installed Apache Qpid Proton-J version in a Maven project
mvn dependency:tree -Dincludes=org.apache.qpid:proton-j

# Upgrade to the fixed release in pom.xml
# <dependency>
#   <groupId>org.apache.qpid</groupId>
#   <artifactId>proton-j</artifactId>
#   <version>0.35.0</version>
# </dependency>