CVE-2026-66277: Apache Qpid Proton-J DoS Vulnerability

CVE-2026-66277 Overview

CVE-2026-66277 is a resource exhaustion vulnerability in Apache Qpid Proton-J, a Java implementation of the Advanced Message Queuing Protocol (AMQP) 1.0. The library does not enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker can send a delivery composed of an excessive number of transfer frames, causing the receiver to consume excessive memory and CPU. This condition can result in a denial of service against services embedding Proton-J. The flaw affects Apache Qpid Proton-J through version 0.34.1 and is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
An authenticated AMQP peer can trigger sustained resource exhaustion in any service using Apache Qpid Proton-J through 0.34.1, disrupting message brokers, gateways, and applications built on the library.

Affected Products

Apache Qpid Proton-J versions up to and including 0.34.1
Applications and services embedding vulnerable Proton-J releases as an AMQP 1.0 client or container
Downstream distributions repackaging Proton-J 0.34.1 or earlier

Discovery Timeline

2026-08-05 - CVE-2026-66277 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66277

Vulnerability Analysis

Apache Qpid Proton-J implements the AMQP 1.0 framing layer, where a single application message (delivery) can be split across multiple transfer performative frames. The library reassembles the payload as frames arrive. Proton-J does not cap the number of transfer frames that may compose a single incoming delivery. An authenticated peer can therefore stream an unbounded sequence of transfer frames tagged as belonging to one delivery, forcing the receiver to buffer state and payload data until memory or CPU resources are exhausted. This aligns with the classification under [CWE-770], missing throttling on resource allocation.

Root Cause

The root cause is the absence of a configurable upper bound on transfer frames per delivery inside the Proton-J receive path. Because reassembly buffers grow with each additional frame, attacker-controlled input directly drives resource consumption. Authentication is required, so the attacker must be a legitimate AMQP peer, but no elevated privileges are needed once a session is established.

Attack Vector

Exploitation occurs over the network against any AMQP 1.0 endpoint using Proton-J. An authenticated client or peer opens a session and link, then transmits a delivery that never signals completion or spans an excessive number of transfer frames. The receiver accumulates buffered content and control state until service degradation or process termination occurs. No user interaction is required. Refer to the Apache mailing list thread and the Openwall OSS-Security update for protocol-level details.

Detection Methods for CVE-2026-66277

Indicators of Compromise

Sustained inbound AMQP sessions from a single peer emitting large numbers of transfer frames without corresponding delivery completion.
Java heap growth, garbage collection pressure, or OutOfMemoryError traces originating in org.apache.qpid.proton packages.
Broker or gateway logs showing stalled deliveries on a specific link with monotonically increasing frame counters.

Detection Strategies

Instrument Proton-J receivers to record per-delivery frame counts and alert when counts exceed expected message sizing envelopes.
Correlate authenticated AMQP session identifiers with abnormal memory or CPU consumption on the hosting JVM.
Inspect network telemetry for long-lived AMQP flows with high frame-per-second rates but low completed-delivery rates.

Monitoring Recommendations

Track JVM heap usage, GC time, and thread state on hosts running Proton-J-based services.
Log AMQP peer identities, remote addresses, and link names to attribute anomalous delivery patterns to specific authenticated accounts.
Alert on repeated connection resets or broker restarts coinciding with traffic from the same authenticated principal.

How to Mitigate CVE-2026-66277

Immediate Actions Required

Upgrade Apache Qpid Proton-J to version 0.35.0 or later, which enforces a bound on transfer frames per delivery.
Inventory all Java services embedding Proton-J, including transitive dependencies pulled in by messaging clients and brokers.
Restrict AMQP access to trusted, authenticated peers and revoke credentials for any account exhibiting the traffic patterns described above.

Patch Information

The Apache Qpid project fixed the issue in Proton-J 0.35.0. Users on 0.34.1 and earlier should upgrade directly to 0.35.0 or a later maintenance release. Rebuild and redeploy any application that shades or repackages Proton-J to ensure the fixed classes are loaded at runtime.

Workarounds

Enforce per-connection memory and CPU limits at the JVM or container level to contain resource exhaustion.
Terminate AMQP sessions that exceed application-defined delivery size or frame-count thresholds before Proton-J buffers grow unbounded.
Place a hardened AMQP proxy or broker in front of Proton-J endpoints to normalize and cap delivery framing.

bash

# Configuration example: pin Proton-J to the fixed release in Maven
mvn versions:use-dep-version \
  -Dincludes=org.apache.qpid:proton-j \
  -DdepVersion=0.35.0 \
  -DforceVersion=true