CVE-2026-67465: Apache Qpid Proton-Dotnet DoS Vulnerability

CVE-2026-67465 Overview

CVE-2026-67465 is a pre-authentication denial of service vulnerability in Apache Qpid Proton-Dotnet, the .NET client library for the Advanced Message Queuing Protocol (AMQP) 1.0. The flaw stems from unbounded symbol value caching, which an unauthenticated remote attacker can exploit to exhaust server resources. Successful exploitation degrades or halts message broker connectivity for legitimate clients. The issue affects all versions of Apache Qpid Proton-Dotnet through 1.0.0 and is fixed in 1.1.0. The weakness is classified as CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A pre-authentication network attacker can trigger resource exhaustion, causing denial of service against applications built on Apache Qpid Proton-Dotnet.

Affected Products

Apache Qpid Proton-Dotnet versions up to and including 1.0.0
.NET applications embedding the Proton-Dotnet AMQP 1.0 client
Messaging services and brokers exposing endpoints reachable by untrusted peers

Discovery Timeline

2026-08-05 - CVE-2026-67465 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-67465

Vulnerability Analysis

Apache Qpid Proton-Dotnet implements AMQP 1.0 framing, which uses symbol types as interned string identifiers for descriptors, capabilities, and property keys. The library caches decoded symbol values to avoid repeated allocations during protocol parsing. Prior to version 1.1.0, this cache had no upper bound.

An attacker who can reach the AMQP endpoint over the network sends crafted frames containing large numbers of unique symbol values. Each unique symbol is inserted into the cache and retained. Memory growth continues until the process exhausts available heap, triggering allocation failures or garbage collection pressure that stalls the application. The attack requires no authentication or user interaction and completes over a single AMQP session.

Root Cause

The root cause is the absence of throttling on the symbol value cache, matching the pattern described by CWE-770. Attacker-controlled input directly drives the size of an internal data structure. The fix in 1.1.0 introduces bounds on the cache to prevent unbounded growth.

Attack Vector

Exploitation occurs across the network against any service that accepts AMQP frames using the vulnerable client library. The attacker establishes a connection and streams frames containing distinct symbol values in fields such as descriptors, delivery annotations, or application properties. See the Apache mailing list thread and Openwall OSS Security post for the vendor's technical description. No verified proof-of-concept exploit code is publicly available.

Detection Methods for CVE-2026-67465

Indicators of Compromise

Sustained memory growth in .NET processes hosting Apache Qpid Proton-Dotnet with no corresponding increase in message throughput
Elevated garbage collection activity and Gen2 heap size in application performance counters during AMQP sessions
Repeated inbound AMQP connections from a single peer containing high-cardinality symbol values in frame headers or properties

Detection Strategies

Inventory .NET applications and dependencies to identify Apache Qpid Proton-Dotnet versions at or below 1.0.0
Instrument AMQP endpoints to record per-connection frame counts, unique symbol counts, and payload entropy
Alert on process working set or private bytes exceeding baseline thresholds while AMQP listener sockets remain active

Monitoring Recommendations

Capture .NET runtime telemetry, including GC Heap Size and # Gen 2 Collections, and correlate spikes with active AMQP peers
Log AMQP connection metadata such as source IP, container-id, and session duration for post-incident review
Forward application and network telemetry to a centralized analytics platform to correlate resource exhaustion patterns across hosts

How to Mitigate CVE-2026-67465

Immediate Actions Required

Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 or later in all affected .NET applications
Restrict network exposure of AMQP endpoints to authenticated peers and trusted network segments
Enforce connection rate limits and per-peer resource quotas on message brokers and gateways fronting Proton-Dotnet clients

Patch Information

The Apache Qpid project has released Apache Qpid Proton-Dotnet 1.1.0, which bounds the symbol value cache and prevents unbounded resource allocation. Users of any version through 1.0.0 should upgrade. Refer to the Apache mailing list thread for the official advisory and release notes.

Workarounds

Place AMQP endpoints behind a broker or proxy that enforces authentication before Proton-Dotnet parses attacker-controlled frames
Apply process-level memory limits, for example through container memory limits or Windows Job Objects, to contain exhaustion attempts
Terminate long-lived AMQP connections that exhibit anomalous symbol cardinality or memory growth

bash

# Example: enforce a memory ceiling for a containerized .NET AMQP service
docker run --memory=512m --memory-swap=512m \
  --name amqp-client \
  my-registry/amqp-service:1.1.0