CVE-2026-66275 Overview
CVE-2026-66275 is a denial of service vulnerability in Apache Qpid Proton-J, a Java implementation of the Advanced Message Queuing Protocol (AMQP) 1.0. An authenticated attacker can exceed the session flow control incoming window, causing resource exhaustion and denial of service against message broker clients and servers using the library. The issue affects all versions of Apache Qpid Proton-J through 0.34.1 and is fixed in version 0.35.0. The vulnerability maps to [CWE-770] (Allocation of Resources Without Limits or Throttling).
Critical Impact
Authenticated attackers can trigger denial of service in AMQP messaging infrastructure built on Apache Qpid Proton-J by bypassing session flow control limits.
Affected Products
- Apache Qpid Proton-J versions through 0.34.1
- Applications embedding Apache Qpid Proton-J for AMQP 1.0 messaging
- Message brokers and clients dependent on Proton-J session flow control
Discovery Timeline
- 2026-08-05 - CVE-2026-66275 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-66275
Vulnerability Analysis
Apache Qpid Proton-J implements AMQP 1.0 session flow control to bound the number of transfer frames a peer may send before receiving additional credit. The incoming window advertises how many frames the receiver is prepared to accept on a given session. Under normal protocol behavior, a sender must not transmit frames beyond this advertised window.
The vulnerability stems from insufficient enforcement of the incoming window boundary on the receiving side. An authenticated peer can transmit frames that exceed the negotiated window, causing the receiver to buffer or process data beyond configured limits. This behavior aligns with [CWE-770], where resource allocation proceeds without proper throttling.
The result is uncontrolled resource consumption within the Proton-J engine. Sustained abuse degrades application responsiveness and can terminate the messaging service.
Root Cause
The root cause is missing or incorrect validation of the session-level incoming window in Proton-J's frame handling logic. The receiver accepts frames beyond the credit it advertised rather than treating the excess as a protocol violation and closing the session.
Attack Vector
Exploitation requires an authenticated AMQP peer connected to a target using Proton-J. The attacker sends transfer frames past the advertised incoming window on an established session. The engine continues processing rather than enforcing the window, leading to resource exhaustion and denial of service. See the Apache Mailing List Thread and the Openwall OSS Security Update for advisory details.
Detection Methods for CVE-2026-66275
Indicators of Compromise
- Elevated Java heap usage or garbage collection pressure on AMQP endpoints running Proton-J
- Session terminations, hung connections, or timeout errors in broker and client logs
- Authenticated AMQP sessions transmitting transfer frames at rates inconsistent with advertised credit
Detection Strategies
- Inventory Java applications and brokers to identify use of org.apache.qpid:proton-j versions at or below 0.34.1
- Monitor AMQP session metrics for mismatches between advertised incoming window and received frame counts
- Correlate authentication events with subsequent spikes in memory usage or thread contention on messaging services
Monitoring Recommendations
- Enable verbose Proton-J transport logging in test environments to baseline normal flow control behavior
- Track JVM metrics (heap, threads, GC pauses) for AMQP services and alert on sustained anomalies
- Log authenticated AMQP client identities and rate-limit repeated session establishment from a single principal
How to Mitigate CVE-2026-66275
Immediate Actions Required
- Upgrade Apache Qpid Proton-J to version 0.35.0 across all applications and broker deployments
- Audit dependency trees for transitive inclusions of proton-j in messaging clients and frameworks
- Restrict AMQP endpoints to trusted authenticated principals until patching is complete
Patch Information
Upgrade to Apache Qpid Proton-J version 0.35.0, which corrects the session flow control enforcement. Details are available in the Apache Mailing List Thread and the Openwall OSS Security Update.
Workarounds
- Enforce strict authentication and authorization on AMQP listeners to limit which peers can open sessions
- Deploy connection and rate limits at network or proxy layers in front of Proton-J services
- Isolate Proton-J workloads with resource quotas (container memory limits, JVM heap caps) to contain denial of service impact
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
