CVE-2026-67554 Overview
CVE-2026-67554 is a denial-of-service vulnerability in Apache Qpid Proton-Dotnet through version 1.0.0. An authenticated attacker can craft a disposition frame containing large or illegal ranges. The library performs naive range handling, which triggers excessive CPU consumption on the target. The flaw is tracked under CWE-606: Unchecked Input for Loop Condition and requires network access with low-privilege authentication. Apache has published a fix in version 1.1.0.
Critical Impact
Authenticated remote attackers can exhaust CPU resources on Qpid Proton-Dotnet consumers by sending a single malformed AMQP disposition frame, disrupting messaging availability.
Affected Products
- Apache Qpid Proton-Dotnet versions up to and including 1.0.0
- .NET applications embedding the Proton-Dotnet AMQP 1.0 client library
- Messaging services relying on Proton-Dotnet for broker or peer communication
Discovery Timeline
- 2026-08-05 - CVE-2026-67554 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67554
Vulnerability Analysis
Apache Qpid Proton-Dotnet implements the Advanced Message Queuing Protocol (AMQP) 1.0 for .NET applications. AMQP uses disposition frames to communicate the state of message transfers between endpoints. Each disposition frame carries a range of delivery identifiers indicating which transfers are being settled or updated.
The vulnerability arises from how the library iterates over these ranges. When a peer submits a disposition frame with an unusually large or logically invalid range, the library processes each identifier in the range without validating upper bounds or range legality. This forces the receiving process into a prolonged loop that consumes CPU time and stalls message processing.
The issue is limited to availability. According to the advisory, confidentiality and integrity are not impacted. The attacker must already possess valid credentials to establish an AMQP session before sending the malicious frame.
Root Cause
The root cause is unchecked input driving a loop condition [CWE-606]. The disposition-frame handler accepts attacker-controlled range values and iterates across them without enforcing reasonable size limits or rejecting inverted or malformed ranges. Naive range expansion turns a small on-wire payload into a costly server-side computation.
Attack Vector
An attacker authenticates to an AMQP endpoint that uses Qpid Proton-Dotnet. The attacker then transmits a disposition frame declaring a first and last delivery identifier that describe an oversized or illegal range. The library expands and processes the range, saturating a CPU core. Repeated frames from one or more sessions can starve the host of processing capacity and cause denial of service.
No verified public exploit code is available at the time of publication. Technical discussion is referenced in the Apache Security Discussion and the Openwall OSS-Security Update.
Detection Methods for CVE-2026-67554
Indicators of Compromise
- Sustained high CPU utilization in .NET processes hosting the Qpid Proton-Dotnet library, correlated with active AMQP sessions.
- AMQP disposition frames with unusually large first and last delivery-id ranges observed in packet captures or broker logs.
- Authenticated AMQP sessions from unexpected principals immediately preceding CPU spikes or message-processing stalls.
Detection Strategies
- Instrument Proton-Dotnet consumers to log disposition frame range sizes and alert when ranges exceed operational norms.
- Deploy network monitoring on AMQP ports (typically 5671/5672) to inspect frame headers for anomalous delivery-id spans.
- Correlate authentication events with process-level CPU metrics to identify low-and-slow denial-of-service attempts.
Monitoring Recommendations
- Track per-connection CPU time and message throughput on Proton-Dotnet endpoints; investigate outliers.
- Alert on repeated session establishment from a single principal followed by throughput degradation.
- Retain AMQP frame telemetry in a centralized log store to enable retrospective hunting after availability incidents.
How to Mitigate CVE-2026-67554
Immediate Actions Required
- Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 on all affected .NET applications and services.
- Audit AMQP account inventories and revoke credentials that are not required, reducing the pool of principals able to submit disposition frames.
- Rate-limit AMQP sessions and frames per authenticated identity to constrain resource consumption from any single peer.
Patch Information
Apache has released Apache Qpid Proton-Dotnet 1.1.0, which addresses the naive range handling in disposition frame processing. Refer to the Apache Security Discussion and the Openwall OSS-Security Update for release details.
Workarounds
- Restrict AMQP access to trusted networks and enforce mutual TLS to reduce the exposure of authenticated endpoints.
- Apply strict authorization policies so only vetted producers and consumers can open sessions on Proton-Dotnet hosts.
- Deploy CPU and connection quotas at the operating system or container level to contain the blast radius of a successful denial-of-service attempt.
# Configuration example
# Update Apache Qpid Proton-Dotnet to the fixed release
dotnet add package Apache.Qpid.Proton.Client --version 1.1.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
