CVE-2026-66274 Overview
CVE-2026-66274 affects Apache Qpid Proton-J, a Java implementation of the Advanced Message Queuing Protocol (AMQP) 1.0. A pre-authentication attacker can leverage type nesting to trigger a StackOverflowError, resulting in denial of service. The flaw is classified under CWE-674: Uncontrolled Recursion. All versions through 0.34.1 are affected, and the Apache Qpid project has released version 0.35.0 to address the issue.
Critical Impact
An unauthenticated remote attacker can crash Qpid Proton-J message processing threads by sending deeply nested AMQP types, disrupting messaging services without any credentials.
Affected Products
- Apache Qpid Proton-J versions through 0.34.1
- Applications embedding Apache Qpid Proton-J for AMQP 1.0 messaging
- Java-based AMQP clients and brokers built on the Proton-J library
Discovery Timeline
- 2026-08-05 - CVE-2026-66274 published to the National Vulnerability Database
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-66274
Vulnerability Analysis
Apache Qpid Proton-J parses AMQP 1.0 wire-format data, which supports composite and container types that may contain other types recursively. The library decodes these nested structures using recursive parsing routines. When an attacker submits a payload containing excessive levels of nested types, the recursive decoder exhausts the Java thread stack and raises a StackOverflowError. This unchecked recursion condition maps to CWE-674.
Because AMQP framing occurs before any authentication handshake completes, the attacker does not need valid credentials to reach the vulnerable decoding path. A single crafted frame can terminate the processing thread and, depending on the host application's error handling, degrade or disable the messaging service.
Root Cause
The root cause is uncontrolled recursion during AMQP type decoding. The Proton-J decoder did not enforce a maximum nesting depth on composite or container types before version 0.35.0. Fixing the issue requires bounding recursion depth or converting the decoder to an iterative approach.
Attack Vector
An attacker with network reachability to a service using Apache Qpid Proton-J sends an AMQP frame containing a deeply nested type structure. The victim invokes the decoder during connection setup, and the recursive parser overflows the stack. No authentication, user interaction, or prior session state is required. See the Apache Mailing List Thread and OpenWall OSS Security Notice for further technical detail.
Detection Methods for CVE-2026-66274
Indicators of Compromise
- java.lang.StackOverflowError entries in application logs referencing Proton-J decoder classes such as org.apache.qpid.proton.codec.
- Repeated abnormal terminations of AMQP listener threads following inbound connections from a single source.
- Sudden spikes in short-lived TCP connections to AMQP ports (typically 5672 or 5671) followed by service errors.
Detection Strategies
- Inspect broker and client logs for stack traces originating in Proton-J type decoding routines after pre-auth connection attempts.
- Correlate AMQP connection resets with error events emitted by the messaging application to isolate malicious sources.
- Deploy network monitoring rules to flag AMQP frames whose declared size or descriptor depth is anomalously large.
Monitoring Recommendations
- Track the Proton-J library version deployed across Java applications using software composition analysis tooling.
- Alert on repeated JVM crashes or thread pool exhaustion events on hosts exposing AMQP endpoints.
- Monitor availability metrics of message brokers and AMQP-facing microservices for unexplained downtime.
How to Mitigate CVE-2026-66274
Immediate Actions Required
- Upgrade Apache Qpid Proton-J to version 0.35.0 or later in all applications and containers that embed the library.
- Restrict network access to AMQP listeners so only trusted producers and consumers can reach them.
- Enable rate limiting and connection quotas on AMQP endpoints to blunt repeated exploitation attempts.
Patch Information
The Apache Qpid project fixed the issue in Proton-J 0.35.0. Users of any release through 0.34.1 should upgrade to 0.35.0 or newer. Release details are available via the Apache Mailing List Thread.
Workarounds
- Place AMQP endpoints behind a proxy or gateway that enforces maximum frame size and rejects malformed payloads.
- Isolate messaging services in dedicated JVMs so a StackOverflowError does not disrupt unrelated components.
- Terminate remote peers that trigger decoder exceptions to prevent repeated exploitation from the same source.
# Configuration example: update Maven dependency to the patched release
mvn versions:use-dep-version -Dincludes=org.apache.qpid:proton-j -DdepVersion=0.35.0 -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
