CVE-2026-67591: Apache Qpid ProtonJ2 DoS Vulnerability

CVE-2026-67591 Overview

CVE-2026-67591 affects Apache Qpid ProtonJ2, a Java implementation of the Advanced Message Queuing Protocol (AMQP) 1.0. An authenticated attacker can exceed the session flow control incoming window, leading to a denial of service (DoS) condition. The issue is classified under CWE-770, Allocation of Resources Without Limits or Throttling. The flaw impacts Apache Qpid ProtonJ2 versions through 1.1.0, and the Apache Qpid project has released version 1.2.0 to remediate the issue.

Critical Impact
Authenticated attackers can exhaust broker resources by exceeding the session flow control window, disrupting AMQP messaging services for legitimate users.

Affected Products

Apache Qpid ProtonJ2 versions through 1.1.0
Applications embedding Apache Qpid ProtonJ2 AMQP client or server libraries
Java-based AMQP 1.0 messaging integrations built on ProtonJ2

Discovery Timeline

2026-08-05 - CVE-2026-67591 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67591

Vulnerability Analysis

Apache Qpid ProtonJ2 implements the AMQP 1.0 protocol, which uses session-level flow control to regulate the volume of message transfers between peers. Each session maintains an incoming window that specifies the maximum number of transfer frames the receiver is prepared to accept. The library failed to correctly enforce this incoming window boundary against a misbehaving peer.

An authenticated attacker can send transfer frames that exceed the negotiated session incoming window. The library continues to accept and process these frames instead of rejecting them or terminating the session. Sustained abuse consumes memory and processing resources on the receiving endpoint, degrading service or causing crashes.

Root Cause

The root cause maps to CWE-770, Allocation of Resources Without Limits or Throttling. The session flow control implementation did not enforce the incoming window as a hard limit. A peer that ignores the advertised window can push the receiver beyond its stated capacity without triggering protocol-level rejection.

Attack Vector

Exploitation requires an authenticated AMQP peer. Once connected, the attacker opens a session and begins sending transfer frames in excess of the incoming window advertised by the receiver. Because the receiver does not reject the surplus frames, the attacker can continue pushing data until resources are exhausted. Technical details are available in the Apache Mailing List Thread and the Openwall OSS-Security Update.

No verified public proof-of-concept code is available. See the referenced advisories for protocol-level details.

Detection Methods for CVE-2026-67591

Indicators of Compromise

Elevated Java Virtual Machine (JVM) heap consumption on hosts running ProtonJ2-based services
Sudden spikes in AMQP transfer frame counts from a single authenticated principal
Session closures accompanied by OutOfMemoryError or resource-exhaustion stack traces in application logs
Latency increases or service unavailability affecting AMQP consumers and producers

Detection Strategies

Instrument ProtonJ2 applications to log the ratio of received transfer frames against the advertised session incoming window
Alert when a single AMQP principal generates a volume of transfer frames disproportionate to historical baselines
Monitor JVM garbage collection pause times and heap usage on brokers and clients that embed ProtonJ2

Monitoring Recommendations

Aggregate AMQP session metrics into a centralized logging or SIEM platform for anomaly analysis
Track authenticated principals by connection count, session count, and message throughput
Configure alerts for repeated abnormal session terminations that correlate with resource exhaustion events

How to Mitigate CVE-2026-67591

Immediate Actions Required

Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later across all affected deployments
Inventory Java applications and containers that bundle the ProtonJ2 library to confirm complete coverage
Rotate or review AMQP credentials to limit which principals can establish authenticated sessions

Patch Information

The Apache Qpid project fixed the flow control enforcement issue in Apache Qpid ProtonJ2 1.2.0. Users of any release through 1.1.0 should upgrade. Refer to the Apache Mailing List Thread and the Openwall OSS-Security Update for release notes and disclosure details.

Workarounds

Restrict AMQP broker access to trusted network segments to reduce the pool of potential authenticated attackers
Apply per-principal connection, session, and message-rate quotas at the broker or reverse proxy layer
Enforce short authentication token lifetimes to reduce the exposure window for compromised credentials

bash

# Example Maven dependency update to the fixed release
# Update pom.xml to reference Apache Qpid ProtonJ2 1.2.0
<dependency>
  <groupId>org.apache.qpid</groupId>
  <artifactId>protonj2-client</artifactId>
  <version>1.2.0</version>
</dependency>