CVE-2026-66276: Apache Qpid Proton-J DoS Vulnerability

CVE-2026-66276 Overview

CVE-2026-66276 is a denial of service vulnerability in Apache Qpid Proton-J, a Java implementation of the AMQP 1.0 protocol engine. An authenticated attacker can craft a disposition frame containing large or illegal ranges. The library's naive range handling then consumes excessive CPU resources while processing the frame, producing a denial of service condition against the messaging endpoint.

The issue affects all versions of Apache Qpid Proton-J through 0.34.1. The Apache Qpid project has released version 0.35.0 to address the flaw. The weakness is tracked as CWE-606: Unchecked Input for Loop Condition.

Critical Impact
An authenticated remote attacker can exhaust CPU on any Java service embedding Qpid Proton-J, disrupting AMQP-based messaging workloads.

Affected Products

Apache Qpid Proton-J versions up to and including 0.34.1
Java applications and brokers that embed Qpid Proton-J for AMQP 1.0 protocol handling
Downstream messaging clients and services depending on the vulnerable library

Discovery Timeline

2026-08-05 - CVE-2026-66276 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66276

Vulnerability Analysis

Apache Qpid Proton-J processes AMQP disposition frames to acknowledge or update the state of message deliveries. Each disposition frame carries a range of delivery identifiers, expressed as a first and last value that the receiver iterates over to update transfer state.

The library expands these ranges without validating their magnitude or ordering. When an attacker specifies a very large range or a semantically illegal range, the processing loop iterates far beyond any legitimate workload. The result is sustained CPU consumption that starves the hosting thread and blocks other AMQP traffic.

Because the flaw resides in frame handling after connection establishment, exploitation requires an authenticated AMQP session. However, any principal with permission to send disposition frames on a link can trigger the condition. Multi-tenant brokers and message routers that accept AMQP 1.0 from customer applications are the most exposed deployments.

Root Cause

The root cause is unchecked input driving a loop condition, categorized as [CWE-606]. Range bounds supplied by the peer are treated as trusted, and the library does not bound the iteration count or reject ranges where last is less than first or where the span exceeds any reasonable delivery window.

Attack Vector

Exploitation proceeds over a valid AMQP 1.0 connection. After authenticating and attaching to a link, the attacker transmits a disposition frame with a crafted range field. The receiver enters a tight processing loop, consuming CPU cycles until the loop completes or the connection is terminated. Repeated frames from one or more sessions amplify the impact into a full denial of service. No memory corruption or code execution primitive is involved. Technical details are documented in the Apache Security Mailing List announcement and the Openwall OSS-Security message.

Detection Methods for CVE-2026-66276

Indicators of Compromise

Sustained high CPU utilization on Java processes hosting Qpid Proton-J with no corresponding increase in legitimate message throughput.
AMQP sessions where authenticated peers transmit disposition frames with unusually large first-to-last spans.
Thread dumps showing worker threads stuck inside Proton-J disposition or range processing methods.

Detection Strategies

Inspect AMQP protocol traces for disposition frames whose range values exceed the number of in-flight deliveries on the link.
Correlate authenticated principal identity with CPU spikes on messaging hosts to isolate abusive clients.
Alert on Java Virtual Machine (JVM) processes where a single thread sustains high CPU while holding AMQP frame decoding stack frames.

Monitoring Recommendations

Ingest broker and application logs, JVM metrics, and network flow data into a centralized analytics platform for correlation.
Track per-session frame rates and range sizes as behavioral baselines, alerting on deviations.
Monitor AMQP client versions in use across the environment to identify hosts still running Qpid Proton-J 0.34.1 or earlier.

How to Mitigate CVE-2026-66276

Immediate Actions Required

Upgrade Apache Qpid Proton-J to version 0.35.0 or later in every application, broker, and client that embeds the library.
Audit AMQP 1.0 endpoints for exposure to untrusted or lower-trust authenticated principals.
Rotate or restrict credentials for AMQP accounts that do not require disposition privileges.

Patch Information

Apache Qpid Proton-J 0.35.0 fixes the naive range handling by bounding disposition range processing. Rebuild and redeploy any application shading or shipping the library, since transitive dependencies will continue to expose the flaw until they are refreshed. Consult the Apache Security Mailing List advisory for the official notice.

Workarounds

Restrict AMQP access so that only trusted, authenticated principals can attach to links and send disposition frames.
Terminate AMQP sessions that generate sustained CPU consumption or malformed frames at the network or broker layer.
Place a protocol-aware proxy in front of exposed AMQP endpoints to filter disposition frames with unreasonable range values.

bash

# Confirm the Qpid Proton-J version bundled with a Java application
unzip -p application.jar META-INF/MANIFEST.MF | grep -i proton

# Force Maven to resolve the fixed version
mvn dependency:tree | grep proton-j
mvn versions:use-dep-version -Dincludes=org.apache.qpid:proton-j -DdepVersion=0.35.0