CVE-2026-67555 Overview
CVE-2026-67555 affects Apache Qpid Proton-Dotnet, a .NET client library implementing the Advanced Message Queuing Protocol (AMQP) 1.0. The library did not enforce a limit on the maximum number of transfer frames per incoming delivery. An authenticated attacker can send a delivery composed of an excessive number of transfer frames, forcing the receiver to consume disproportionate memory and processing resources. This behavior maps to [CWE-770] Allocation of Resources Without Limits or Throttling. Successful exploitation results in resource exhaustion and denial of service against messaging endpoints built on the affected library.
Critical Impact
An authenticated remote attacker can trigger sustained resource exhaustion on Apache Qpid Proton-Dotnet consumers, degrading or halting AMQP-based messaging workloads.
Affected Products
- Apache Qpid Proton-Dotnet versions up to and including 1.0.0
- Applications embedding Proton-Dotnet as an AMQP 1.0 client or server library
- .NET services that accept AMQP deliveries from partially trusted peers
Discovery Timeline
- 2026-08-05 - CVE-2026-67555 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67555
Vulnerability Analysis
AMQP 1.0 allows a single message delivery to be split across multiple transfer frames. Each frame carries a fragment of the payload and is reassembled by the receiver. Apache Qpid Proton-Dotnet did not cap the number of transfer frames accepted per delivery. An authenticated peer can therefore stream an unbounded sequence of transfer frames tied to one logical delivery.
As frames accumulate, the receiver allocates buffers, tracks delivery state, and performs reassembly work for a payload that never completes. Memory and CPU consumption grow with attacker-controlled input. The impact is confined to availability, consistent with the vulnerability's integrity and confidentiality-neutral profile.
Root Cause
The root cause is missing input governance on a protocol-level counter. The library trusted peers to send a reasonable number of frames per delivery and did not enforce an upper bound. This is a classic resource-allocation flaw where a protocol parser accepts unbounded repetition of an otherwise valid message element.
Attack Vector
Exploitation requires network reachability to the AMQP endpoint and valid credentials to establish an authenticated session. Once a link is attached, the attacker initiates a delivery and sends a large number of small transfer frames without setting the terminal more=false marker in a timely fashion. The receiver continues consuming and buffering frames until resources are exhausted. No user interaction is required, and attack complexity is low.
No verified exploit code is publicly available. Refer to the Apache Mailing List Discussion and the OpenWall OSS Security Update for protocol-level details.
Detection Methods for CVE-2026-67555
Indicators of Compromise
- Sustained inbound AMQP transfer frame sequences from a single authenticated peer without delivery completion.
- Rapid memory growth in .NET processes hosting Apache Qpid Proton-Dotnet listeners.
- Long-lived deliveries where frame counts far exceed historical baselines for the workload.
Detection Strategies
- Instrument the Proton-Dotnet receiver to log per-delivery frame counts and alert on outliers.
- Correlate AMQP session identifiers with process memory and CPU metrics to identify abusive peers.
- Track deliveries that remain incomplete beyond expected timeouts and flag associated principals.
Monitoring Recommendations
- Baseline the normal number of transfer frames per delivery for each producer role and alert on deviations.
- Monitor .NET garbage collection pressure, working set size, and thread pool saturation on AMQP hosts.
- Forward AMQP broker and application logs to a centralized analytics platform for anomaly review.
How to Mitigate CVE-2026-67555
Immediate Actions Required
- Upgrade Apache Qpid Proton-Dotnet to version 1.1.0, which enforces a maximum number of transfer frames per delivery.
- Inventory .NET applications and services that reference the Proton-Dotnet package and prioritize internet-exposed endpoints.
- Rotate or restrict credentials for AMQP principals that do not require write access to sensitive links.
Patch Information
Apache has released Apache Qpid Proton-Dotnet 1.1.0 with a fix that governs the maximum number of transfer frames accepted per incoming delivery. Users of any version up to and including 1.0.0 should upgrade. See the Apache Mailing List Discussion for release details.
Workarounds
- Restrict AMQP listener access to trusted network segments using firewall rules or private link connectivity.
- Apply per-principal quotas and rate limits at an upstream AMQP broker or reverse proxy where supported.
- Enforce short idle and delivery timeouts to close sessions that fail to complete deliveries.
- Monitor and terminate sessions exhibiting abnormal frame-per-delivery ratios until the patch is deployed.
# Configuration example: upgrade the Proton-Dotnet package reference to the fixed version
dotnet add package Apache.Qpid.Proton.Client --version 1.1.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
