CVE-2026-67590: Apache Qpid ProtonJ2 DoS Vulnerability

CVE-2026-67590 Overview

CVE-2026-67590 is a denial of service vulnerability in Apache Qpid ProtonJ2, an AMQP 1.0 protocol engine library used in Java messaging clients. A pre-authentication attacker can leverage deeply nested type structures to trigger a StackOverflowError during message parsing. The flaw stems from uncontrolled recursion [CWE-674] when decoding nested AMQP types.

The vulnerability affects all versions of Apache Qpid ProtonJ2 through 1.1.0. Apache has released version 1.2.0 to address the issue. Because exploitation requires no authentication, any network-reachable service using a vulnerable ProtonJ2 build can be disrupted by a crafted AMQP frame.

Critical Impact
Unauthenticated attackers can crash Apache Qpid ProtonJ2 endpoints by sending crafted AMQP frames with deeply nested types, causing a StackOverflowError and service disruption.

Affected Products

Apache Qpid ProtonJ2 versions through 1.1.0
Java applications embedding vulnerable ProtonJ2 as an AMQP client or server library
Messaging infrastructure and brokers depending on ProtonJ2 for AMQP 1.0 protocol handling

Discovery Timeline

2026-08-05 - CVE-2026-67590 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67590

Vulnerability Analysis

CVE-2026-67590 is categorized as Uncontrolled Recursion [CWE-674]. Apache Qpid ProtonJ2 decodes AMQP 1.0 wire-format messages that support composite and nested data types including lists, maps, and arrays. The decoder recursively processes each nested element as it walks the type tree.

When an attacker submits a frame containing deeply nested types, the recursive decoder consumes one Java thread stack frame per nesting level. Once the nesting depth exceeds the JVM's configured stack size, the runtime raises a StackOverflowError. This unhandled error terminates the processing thread and can crash or degrade the AMQP endpoint.

Because AMQP negotiation and type decoding occur before SASL authentication completes on many ProtonJ2 code paths, the attack is reachable without credentials. Repeated frames can produce a sustained denial of service against messaging brokers and clients.

Root Cause

The root cause is the absence of a maximum nesting depth check in the AMQP type decoder. The decoder trusts the wire format and continues recursing regardless of structural depth, allowing attacker-controlled input to exhaust thread stack space.

Attack Vector

Exploitation requires only network access to a ProtonJ2 listener. An attacker crafts an AMQP frame whose payload contains a list, map, or array recursively wrapping additional composite types to an arbitrary depth. Sending this frame during connection establishment triggers the StackOverflowError inside the decoder before any authentication check occurs. Refer to the Apache Mailing List Thread and OpenWall OSS Security Bulletin for protocol-level details.

Detection Methods for CVE-2026-67590

Indicators of Compromise

java.lang.StackOverflowError entries in application logs originating from ProtonJ2 decoder classes such as those in org.apache.qpid.protonj2.codec
Abrupt termination of AMQP connection handler threads without a corresponding clean disconnect
Repeated short-lived AMQP connections from a single remote source that end in decoder exceptions

Detection Strategies

Inspect AMQP frame payloads at ingress for abnormal nesting depth in list, map, or array types
Correlate StackOverflowError stack traces with ProtonJ2 codec packages to distinguish this vulnerability from unrelated JVM crashes
Alert on process restarts of messaging services following AMQP protocol errors on unauthenticated connections

Monitoring Recommendations

Track connection failure rates and decoder exception counts on ProtonJ2-based services
Monitor JVM stack overflow error frequency across broker and client instances
Enable network flow logging on AMQP ports (5671, 5672) to identify unauthenticated sources sending malformed frames

How to Mitigate CVE-2026-67590

Immediate Actions Required

Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later across all applications, brokers, and clients
Inventory Java services and dependencies to identify transitive use of ProtonJ2 through messaging frameworks
Restrict network exposure of AMQP listeners to trusted peers until patching completes

Patch Information

Apache has released Apache Qpid ProtonJ2 version 1.2.0, which addresses the uncontrolled recursion in the AMQP type decoder. All users of versions through 1.1.0 should upgrade. Consult the Apache Mailing List Thread for the official upgrade guidance.

Workarounds

Place ProtonJ2 endpoints behind a network filter that limits AMQP frame size and rejects excessively large payloads
Restrict AMQP listener reachability to authenticated network segments using firewall rules or mTLS front-ends
Configure connection rate limits to reduce the impact of repeated crash attempts while patching is in progress

bash

# Example Maven dependency update to the fixed version
# In pom.xml, update the ProtonJ2 dependency:
#
# <dependency>
#   <groupId>org.apache.qpid</groupId>
#   <artifactId>protonj2</artifactId>
#   <version>1.2.0</version>
# </dependency>

mvn versions:set-property -Dproperty=protonj2.version -DnewVersion=1.2.0
mvn clean verify