CVE-2026-67588: Apache Qpid ProtonJ2 DoS Vulnerability

CVE-2026-67588 Overview

CVE-2026-67588 is a pre-authentication denial-of-service vulnerability in Apache Qpid ProtonJ2. The flaw stems from unbounded symbol value caching in the AMQP protocol library. An unauthenticated remote attacker can send crafted protocol messages that force the library to cache symbol values without limit, exhausting available memory and causing service disruption.

The vulnerability affects all Apache Qpid ProtonJ2 versions through 1.1.0. The Apache Qpid project has released version 1.2.0 to remediate the issue. The weakness is categorized under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
A remote unauthenticated attacker can trigger memory exhaustion in any application embedding Apache Qpid ProtonJ2 through 1.1.0, disrupting message broker availability.

Affected Products

Apache Qpid ProtonJ2 versions through 1.1.0
Applications and services embedding the vulnerable ProtonJ2 AMQP client/server library
Message brokers and AMQP endpoints built on Qpid ProtonJ2

Discovery Timeline

2026-08-05 - CVE-2026-67588 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-67588

Vulnerability Analysis

Apache Qpid ProtonJ2 is a Java implementation of the Advanced Message Queuing Protocol (AMQP) 1.0. The library maintains internal caches for AMQP Symbol values received during protocol exchanges. Symbols are string-like identifiers used throughout the AMQP wire protocol for property keys, capabilities, and metadata.

The vulnerable versions cache these symbol values without applying a maximum size or eviction policy. A remote attacker can open an AMQP connection and transmit frames containing a large number of unique symbol values before authentication completes. Each unique symbol is retained in memory indefinitely, consuming heap space until the Java Virtual Machine exhausts available memory.

The attack results in application unavailability, garbage collection thrashing, and potential process termination. The confidentiality and integrity of data remain unaffected; the impact is limited to availability.

Root Cause

The root cause is missing enforcement of resource limits on an internal symbol cache. The library treats untrusted, pre-authentication protocol input as data eligible for indefinite caching. This maps directly to [CWE-770] (Allocation of Resources Without Limits or Throttling).

Attack Vector

Exploitation requires only network reachability to a listening AMQP endpoint. No credentials, user interaction, or elevated privileges are needed. An attacker establishes a TCP connection to the AMQP port, initiates the AMQP handshake, and floods the peer with frames containing distinct symbol values. Because caching occurs before authentication, no valid account is required.

Refer to the Apache Mailing List Thread and the OpenWall OSS Security Update for the project's technical description.

Detection Methods for CVE-2026-67588

Indicators of Compromise

Sustained growth of Java heap usage on hosts running Apache Qpid ProtonJ2 without a corresponding growth in legitimate message throughput.
Repeated OutOfMemoryError exceptions or full garbage collection cycles in ProtonJ2-based application logs.
AMQP connections from single or few source IPs that transmit unusually large volumes of unique symbol values pre-authentication.
Abrupt loss of AMQP broker availability without configuration or deployment changes.

Detection Strategies

Inventory Java applications and container images for protonj2 JAR files at versions 1.1.0 or earlier using software composition analysis.
Monitor JVM metrics (heap used, GC pause time, GC frequency) on AMQP-facing services and alert on sustained abnormal growth.
Inspect AMQP broker logs for authentication failures or dropped connections that correlate with memory pressure events.
Track connection-level metrics such as unique symbol counts per session where instrumentation permits.

Monitoring Recommendations

Enable JVM flight recording or heap dump on OutOfMemoryError for ProtonJ2-based services to preserve forensic evidence.
Alert on any AMQP source IP that opens connections but never completes SASL authentication.
Correlate network telemetry with process availability data to identify DoS attempts against messaging infrastructure.

How to Mitigate CVE-2026-67588

Immediate Actions Required

Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later across all deployments, including transitive dependencies in downstream applications.
Restrict network exposure of AMQP endpoints to trusted network segments or VPN-reachable peers until patching is complete.
Rebuild and redeploy any container images or fat JARs that bundle the vulnerable library.

Patch Information

The Apache Qpid project addressed CVE-2026-67588 in Apache Qpid ProtonJ2 1.2.0. Users of any 1.x release through 1.1.0 should upgrade. Consult the Apache Mailing List Thread for release notes and the OpenWall OSS Security Update for the coordinated disclosure notice.

Workarounds

Place AMQP endpoints behind a reverse proxy or firewall that enforces connection rate limits and per-source connection quotas.
Constrain JVM heap sizing and enable rapid restart policies to reduce blast radius until the library is upgraded.
Disable public-facing AMQP listeners where they are not required for business operations.

bash

# Verify Apache Qpid ProtonJ2 version in a Maven project and upgrade
mvn dependency:tree | grep -i protonj2

# Update Maven dependency to the fixed release
# <dependency>
#   <groupId>org.apache.qpid</groupId>
#   <artifactId>protonj2</artifactId>
#   <version>1.2.0</version>
# </dependency>

# Scan container images for vulnerable JARs
find / -name 'protonj2-*.jar' 2>/dev/null