CVE-2026-67589: Apache Qpid ProtonJ2 DoS Vulnerability

CVE-2026-67589 Overview

CVE-2026-67589 is a pre-authentication denial of service vulnerability in Apache Qpid ProtonJ2, an AMQP 1.0 protocol engine library used to build Java-based messaging clients and servers. The flaw resides in how the library handles type size and count values during AMQP frame decoding. An unauthenticated remote attacker can send crafted protocol data that triggers excessive memory allocation, exhausting resources and disrupting service availability. The issue affects all Apache Qpid ProtonJ2 releases through version 1.1.0 and is fixed in version 1.2.0. This weakness is categorized under CWE-789: Memory Allocation with Excessive Size Value.

Critical Impact
A remote unauthenticated attacker can crash or degrade any service embedding Apache Qpid ProtonJ2 through 1.1.0 by sending malformed AMQP frames that induce excessive memory allocation.

Affected Products

Apache Qpid ProtonJ2 versions through 1.1.0
Java applications and services embedding the Qpid ProtonJ2 AMQP 1.0 engine
Messaging brokers and clients built on the ProtonJ2 library

Discovery Timeline

2026-08-05 - CVE-2026-67589 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67589

Vulnerability Analysis

Apache Qpid ProtonJ2 implements the AMQP 1.0 wire protocol, which encodes typed data with explicit size and count fields. During decoding, the library reads these size and count values from the incoming byte stream and allocates buffers or collections to hold the decoded elements. When the values are not validated against the actual remaining frame payload, an attacker can advertise very large sizes or counts while sending only a small amount of data. The decoder then attempts to allocate structures large enough to accommodate the advertised values, consuming heap memory disproportionate to the network input. Repeated frames of this form drive the Java Virtual Machine toward OutOfMemoryError conditions and degrade or terminate the affected process.

Root Cause

The root cause is missing or insufficient bounds checking on type size and count metadata in the AMQP decoder. The library trusts attacker-supplied length fields before verifying that the underlying buffer contains enough bytes to justify the requested allocation. This matches the [CWE-789] pattern where an untrusted numeric input drives allocation size directly.

Attack Vector

The vulnerability is reachable pre-authentication because AMQP frame decoding occurs before any SASL or connection-level authentication completes. An attacker only needs network reachability to a listener that uses Apache Qpid ProtonJ2 to parse incoming frames. Sending a small number of crafted frames with inflated size or count descriptors is sufficient to trigger the excessive allocation and cause a denial of service.

No verified public proof-of-concept code is available. Refer to the Apache Mailing List Thread and the Openwall OSS-Security Update for the vendor description of the flaw.

Detection Methods for CVE-2026-67589

Indicators of Compromise

OutOfMemoryError or java.lang.OutOfMemoryError: Java heap space entries in application logs associated with AMQP frame decoding stack traces referencing org.apache.qpid.protonj2 decoder classes.
Sudden JVM heap growth or garbage collection thrashing coinciding with inbound AMQP traffic on ports such as 5672 or 5671.
Repeated abrupt connection resets or process restarts on services that embed Apache Qpid ProtonJ2 through 1.1.0.

Detection Strategies

Inspect AMQP traffic for frames where declared type size or count fields are disproportionate to the actual frame payload length.
Correlate JVM memory metrics with AMQP session establishment events to detect allocation spikes from unauthenticated peers.
Track version telemetry across the estate to identify hosts still running Apache Qpid ProtonJ2 releases prior to 1.2.0.

Monitoring Recommendations

Enable JVM heap and garbage collection monitoring on any service that embeds Apache Qpid ProtonJ2 and alert on sustained heap pressure.
Log source IP addresses and connection identifiers for AMQP peers that trigger decoder exceptions or connection termination.
Rate-limit and alert on repeated protocol-level failures from the same remote endpoint before authentication completes.

How to Mitigate CVE-2026-67589

Immediate Actions Required

Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later in all affected applications and redeploy dependent services.
Inventory every Java service that transitively depends on org.apache.qpid:protonj2 and confirm the resolved version after the upgrade.
Restrict network exposure of AMQP listeners to trusted network segments until patched builds are in production.

Patch Information

The Apache Qpid project fixes the issue in Apache Qpid ProtonJ2 version 1.2.0. Update the protonj2 dependency in Maven or Gradle build configurations and rebuild downstream artifacts. Details are published in the Apache Mailing List Thread and the Openwall OSS-Security Update.

Workarounds

Place AMQP listeners behind a network policy that limits access to authenticated peers or known client subnets.
Apply per-connection resource ceilings at the JVM or container level so a single peer cannot exhaust host memory.
Terminate AMQP connections that generate decoder exceptions and block the originating source at the network layer.

bash

# Maven dependency update to the fixed release
# Replace the vulnerable version with 1.2.0 or later
mvn versions:use-dep-version \
  -Dincludes=org.apache.qpid:protonj2 \
  -DdepVersion=1.2.0 \
  -DforceVersion=true

# Verify no vulnerable versions remain on the classpath
mvn dependency:tree | grep protonj2