CVE-2026-67552: Apache Qpid Proton-Dotnet DoS Vulnerability

CVE-2026-67552 Overview

CVE-2026-67552 is a denial-of-service vulnerability in Apache Qpid Proton-Dotnet, the .NET client library for the Advanced Message Queuing Protocol (AMQP) 1.0. A pre-authentication attacker can leverage deeply nested type structures to trigger a StackOverflowError during message decoding. The uncontrolled recursion causes the process to terminate, disrupting messaging services that rely on the library. The issue affects Apache Qpid Proton-Dotnet through version 1.0.0 and is addressed in version 1.1.0. The underlying weakness is classified under CWE-674: Uncontrolled Recursion.

Critical Impact
Remote, unauthenticated attackers can crash Qpid Proton-Dotnet based services by sending crafted AMQP payloads with deeply nested types, resulting in denial of service.

Affected Products

Apache Qpid Proton-Dotnet versions up to and including 1.0.0
.NET applications embedding the Qpid Proton-Dotnet AMQP 1.0 client
Messaging brokers and services integrating Qpid Proton-Dotnet for AMQP connectivity

Discovery Timeline

2026-08-05 - CVE-2026-67552 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67552

Vulnerability Analysis

Apache Qpid Proton-Dotnet parses AMQP 1.0 wire-format messages that support composite and nested type structures. The decoder processes these types recursively without enforcing a depth limit. An attacker who can reach the AMQP endpoint can send a payload containing excessive type nesting before any authentication step completes. Each nesting level consumes stack frames until the runtime raises a StackOverflowError. Because .NET stack overflow exceptions cannot be reliably caught, the hosting process terminates, producing a denial-of-service condition. The vulnerability requires no credentials and no user interaction, and it targets the availability of any service embedding the affected library. Consult the Apache mailing list thread and the Openwall OSS Security update for the maintainer disclosure.

Root Cause

The root cause is uncontrolled recursion [CWE-674] in the AMQP type decoder. The parser recurses into nested composite types without validating the nesting depth against a bounded limit, allowing attacker-controlled input to exhaust the thread stack.

Attack Vector

An unauthenticated remote attacker sends a crafted AMQP frame with deeply nested types to a listener backed by Qpid Proton-Dotnet. Decoding occurs before authentication completes, so no credentials are required. The resulting StackOverflowError crashes the host process.

No verified public proof-of-concept code is available at the time of publication. See the referenced Apache and Openwall advisories for the maintainer's technical description.

Detection Methods for CVE-2026-67552

Indicators of Compromise

Unexpected termination of .NET processes hosting Qpid Proton-Dotnet with StackOverflowException entries in Windows Event Log or systemd journal
Repeated short-lived AMQP connections from a single source followed by service restarts
Crash dumps referencing the Qpid Proton-Dotnet decoder call stack with deep recursive frames

Detection Strategies

Inspect application and container logs for recurring StackOverflowException events tied to AMQP message intake
Correlate AMQP listener process restarts with inbound connections from untrusted networks
Deploy AMQP-aware network inspection to flag frames with abnormal type nesting depth

Monitoring Recommendations

Alert on abnormal restart rates for services embedding Apache.Qpid.Proton assemblies
Track AMQP connection error counters and disconnect reasons at the broker or gateway
Baseline expected message sizes and structural complexity, and flag statistical outliers

How to Mitigate CVE-2026-67552

Immediate Actions Required

Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 or later in all affected applications
Inventory .NET services and container images for references to Apache.Qpid.Proton and rebuild against the fixed version
Restrict AMQP listener exposure to trusted networks until patching is complete

Patch Information

Upgrade to Apache Qpid Proton-Dotnet 1.1.0, which fixes the uncontrolled recursion in the AMQP type decoder. Refer to the Apache mailing list thread for the official maintainer announcement and the Openwall OSS Security update for coordinated disclosure details.

Workarounds

Place the AMQP listener behind a broker or gateway that enforces frame size and structural limits on inbound messages
Apply network access controls to restrict AMQP endpoints to authenticated peers and trusted subnets
Run affected services under supervisors that automatically restart on crash to reduce outage duration while patching proceeds

bash

# Update the NuGet package reference to the fixed release
dotnet add package Apache.Qpid.Proton.Client --version 1.1.0
dotnet restore
dotnet build --configuration Release