CVE-2026-67551: Apache Qpid Proton-Dotnet DoS Vulnerability

CVE-2026-67551 Overview

CVE-2026-67551 is a pre-authentication denial of service vulnerability in Apache Qpid Proton-Dotnet. The flaw resides in how the library handles type size and count values during message processing. An unauthenticated remote attacker can craft input that triggers excessive memory allocation, exhausting resources on the target process.

The issue affects Apache Qpid Proton-Dotnet through version 1.0.0. The Apache Qpid project has released version 1.1.0 to remediate the flaw. The vulnerability is tracked under [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
An unauthenticated attacker can trigger memory exhaustion in applications using Apache Qpid Proton-Dotnet, causing denial of service without prior credentials.

Affected Products

Apache Qpid Proton-Dotnet versions up to and including 1.0.0
.NET applications embedding the Qpid Proton-Dotnet AMQP client library
Messaging services and brokers built on the affected library versions

Discovery Timeline

2026-08-05 - CVE CVE-2026-67551 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67551

Vulnerability Analysis

Apache Qpid Proton-Dotnet is a .NET client library implementing the Advanced Message Queuing Protocol (AMQP) 1.0. The library parses type-length-value encoded frames from remote peers. The vulnerability arises when the parser trusts declared size or count fields in incoming AMQP data without validating them against available resources or reasonable bounds.

An attacker can send an AMQP frame declaring a very large collection or binary payload. The library then attempts to allocate memory sized according to the attacker-controlled field. This forces the .NET runtime to reserve large buffers before the actual data is received, exhausting heap memory.

Because AMQP handshakes accept frames before authentication completes, the attacker does not require valid credentials. Repeated or single crafted frames can crash the service or degrade shared hosts. See the Apache Security Mailing List Post and the Openwall OSS Security Discussion for the vendor advisory.

Root Cause

The root cause is improper validation of size and count fields during AMQP type decoding. The decoder allocates buffers based on untrusted length values before verifying that the declared data is actually present on the wire. This pattern maps to [CWE-789].

Attack Vector

Exploitation requires network access to an AMQP endpoint using the vulnerable library. The attacker establishes a TCP connection and sends a malformed AMQP frame during the pre-authentication phase. No valid credentials, session state, or user interaction are required.

No verified public exploit code is available. The vulnerability mechanism is described in prose here; refer to the vendor advisory linked above for protocol-level detail.

Detection Methods for CVE-2026-67551

Indicators of Compromise

Sudden spikes in managed heap size or working set on .NET processes hosting AMQP endpoints
OutOfMemoryException events in .NET application logs correlated with AMQP connection attempts
Repeated short-lived TCP connections to AMQP ports (5672, 5671) from unauthenticated sources followed by process termination

Detection Strategies

Inventory .NET applications and identify dependencies on Apache.Qpid.Proton or Apache.Qpid.Proton.Client at versions 1.0.0 or earlier
Enable AMQP protocol logging on brokers and clients to capture frame sizes and connection sources
Correlate application crashes with pre-authentication AMQP traffic to identify exploitation attempts

Monitoring Recommendations

Alert on process restarts of services embedding the Qpid Proton-Dotnet library
Monitor memory allocation rate and garbage collection pressure on AMQP-facing hosts
Track connection volume from unauthenticated peers on AMQP listener ports

How to Mitigate CVE-2026-67551

Immediate Actions Required

Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 or later across all affected applications
Restrict network exposure of AMQP listener ports to trusted network segments only
Enforce TLS and client certificate authentication at the transport layer where feasible

Patch Information

The Apache Qpid project addressed CVE-2026-67551 in Apache Qpid Proton-Dotnet version 1.1.0. Users should update the Apache.Qpid.Proton.Client NuGet package reference to 1.1.0 or newer and redeploy dependent applications. See the Apache Security Mailing List Post for the official vendor notice.

Workarounds

Place AMQP endpoints behind a reverse proxy or firewall that enforces connection rate limits and source filtering
Set per-process memory limits using operating system controls to contain memory exhaustion impact
Terminate long-lived unauthenticated AMQP sessions aggressively at the network layer until patching is complete

bash

# Update the Qpid Proton-Dotnet package to the fixed version
dotnet add package Apache.Qpid.Proton.Client --version 1.1.0
dotnet restore
dotnet build --configuration Release