CVE-2026-66273: Apache Qpid Proton-J DoS Vulnerability

CVE-2026-66273 Overview

CVE-2026-66273 is a pre-authentication denial of service vulnerability in Apache Qpid Proton-J. The flaw resides in how the library handles Advanced Message Queuing Protocol (AMQP) type size and count fields during message decoding. An unauthenticated remote attacker can send a crafted AMQP frame that triggers excessive memory allocation, exhausting resources on the target Java Virtual Machine (JVM). The issue affects all versions of Apache Qpid Proton-J through 0.34.1, and is fixed in version 0.35.0. The weakness is tracked as [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
Unauthenticated attackers can crash or degrade AMQP-based messaging services by sending a single malformed frame, disrupting downstream applications that depend on the broker or client.

Affected Products

Apache Qpid Proton-J versions up to and including 0.34.1
Java applications embedding Qpid Proton-J for AMQP 1.0 messaging
Downstream products bundling vulnerable Proton-J releases

Discovery Timeline

2026-08-05 - CVE-2026-66273 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-66273

Vulnerability Analysis

Apache Qpid Proton-J is a Java implementation of the AMQP 1.0 protocol. AMQP messages encode composite and collection types using explicit size and count prefixes that describe how many bytes and elements follow. Proton-J trusts these declared values when preparing internal buffers and collections during decoding.

An attacker who can reach the AMQP listener sends a frame declaring an extremely large element count or size. The decoder allocates memory proportional to the attacker-controlled value before validating that sufficient bytes are actually present on the wire. The allocation exhausts the JVM heap and produces an OutOfMemoryError, terminating message processing threads or the entire process.

Because AMQP negotiation happens before Simple Authentication and Security Layer (SASL) authentication completes, the attack requires no credentials. A single small packet on the network can force allocation of gigabytes of heap memory.

Root Cause

The root cause is missing validation of decoded length and count fields against the remaining bytes in the input buffer. The decoder uses declared type metadata to size internal arrays and ByteBuffer instances directly, without capping the value or cross-checking it against actual frame length.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker establishes a Transmission Control Protocol (TCP) connection to any endpoint using Proton-J for AMQP transport and transmits a malformed frame during protocol negotiation. Repeated frames amplify the resource exhaustion. See the Apache Email Thread Discussion and the Openwall OSS Security Update for protocol-level details.

Detection Methods for CVE-2026-66273

Indicators of Compromise

Repeated java.lang.OutOfMemoryError events in application logs originating from org.apache.qpid.proton decoder classes
Abnormal spikes in JVM heap usage correlated with inbound AMQP connections on port 5672 or 5671
Short-lived TCP sessions from untrusted sources that terminate immediately after the AMQP protocol header exchange

Detection Strategies

Inspect AMQP frames at the network layer for declared size or count fields that exceed the frame's actual byte length
Correlate JVM garbage collection pressure and heap exhaustion events with source IP addresses initiating AMQP handshakes
Alert on process restarts of AMQP brokers and clients coinciding with inbound connection attempts from unexpected peers

Monitoring Recommendations

Enable verbose Proton-J transport logging in non-production environments to capture decoder exceptions and frame contents
Track memory metrics (heap_used, gc_pause_ms) per service and alert on rapid growth patterns
Log and review all pre-authentication AMQP sessions, retaining source IP, timestamp, and disconnect reason

How to Mitigate CVE-2026-66273

Immediate Actions Required

Upgrade Apache Qpid Proton-J to version 0.35.0 or later on all servers, clients, and embedded applications
Inventory Java applications and third-party products that bundle Proton-J and apply vendor updates as they become available
Restrict inbound access to AMQP listeners to trusted network segments until patching is complete

Patch Information

The Apache Qpid project fixed the issue in Proton-J 0.35.0 by validating declared type sizes and counts against the remaining bytes in the frame before allocating memory. Users of any version through 0.34.1 must upgrade. Refer to the Apache Email Thread Discussion for the release announcement.

Workarounds

Place vulnerable AMQP endpoints behind a network firewall or reverse proxy that terminates untrusted connections
Enforce mutual Transport Layer Security (mTLS) so that only clients with valid certificates can reach the AMQP handshake
Constrain JVM heap size and configure process supervisors to restart affected services automatically after OutOfMemoryError

bash

# Verify the Proton-J version bundled with your application
find . -name 'proton-j-*.jar' -exec basename {} \;

# Example Maven dependency update
# <dependency>
#   <groupId>org.apache.qpid</groupId>
#   <artifactId>proton-j</artifactId>
#   <version>0.35.0</version>
# </dependency>