CVE-2026-67592 Overview
CVE-2026-67592 is a resource exhaustion vulnerability in Apache Qpid ProtonJ2 through version 1.1.0. The library fails to enforce a maximum number of transfer frames per incoming delivery. An authenticated attacker can send crafted deliveries with excessive transfer frames, driving up memory and processing costs. The result is degraded availability or full denial of service on the receiving endpoint. The Apache Qpid project has released version 1.2.0 to address the flaw. The weakness is classified under CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
Authenticated attackers can trigger high-impact denial of service against AMQP 1.0 endpoints built on Apache Qpid ProtonJ2 by flooding a single delivery with unbounded transfer frames.
Affected Products
- Apache Qpid ProtonJ2 versions up to and including 1.1.0
- Java applications and services embedding ProtonJ2 as their AMQP 1.0 client or server library
- Messaging brokers and integrations relying on ProtonJ2 for AMQP transport
Discovery Timeline
- 2026-08-05 - CVE-2026-67592 published to the National Vulnerability Database
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67592
Vulnerability Analysis
Apache Qpid ProtonJ2 implements the AMQP 1.0 protocol for Java applications. AMQP messages can be split into multiple transfer frames that a receiver reassembles into a single delivery. ProtonJ2 through 1.1.0 does not cap how many transfer frames may compose one delivery. An authenticated peer can therefore stream an unbounded sequence of transfer frames tied to a single logical delivery. The receiver continues buffering frame state, consuming memory and CPU until resources are exhausted. Because the attack is network-reachable and requires no user interaction, any authenticated client that can open a link to the server can trigger it.
Root Cause
The root cause is missing input validation on protocol-level accounting, mapped to [CWE-770]. The frame handling path lacks a configurable ceiling on transfer frames per delivery. Without throttling, the library treats every incoming transfer frame as legitimate work and allocates the associated buffers and metadata.
Attack Vector
An attacker authenticates to an AMQP 1.0 endpoint using ProtonJ2, opens a session and link, and initiates a delivery. The attacker then sends a stream of transfer frames belonging to that delivery without ever setting the more flag to false. The receiver accumulates partial message state indefinitely. Repeating this across links or connections amplifies the impact against the target process.
No verified public exploit code is available. See the Apache Mailing List Discussion and the Openwall OSS Security Update for protocol-level details.
Detection Methods for CVE-2026-67592
Indicators of Compromise
- Sustained growth of Java heap or off-heap memory in processes hosting Apache Qpid ProtonJ2 without a matching increase in completed message deliveries.
- AMQP sessions where a single delivery ID receives an unusually high volume of transfer frames with the more flag continuously set to true.
- Repeated OutOfMemoryError or garbage collection pressure events in application logs correlated with active AMQP client connections.
Detection Strategies
- Instrument ProtonJ2-based services to record per-delivery transfer-frame counts and alert when values exceed expected message sizes.
- Correlate authenticated AMQP client identities with abnormal per-connection byte and frame rates to isolate malicious peers.
- Inspect network telemetry from AMQP brokers for long-lived deliveries that never complete, which indicates unterminated frame streams.
Monitoring Recommendations
- Track JVM memory metrics, thread counts, and GC pause durations for services embedding ProtonJ2 and alert on sustained anomalies.
- Log AMQP link and session lifecycle events with authenticated principal identifiers to support attribution during a resource-exhaustion event.
- Forward broker and application logs into a centralized analytics platform to detect denial-of-service patterns across multiple hosts.
How to Mitigate CVE-2026-67592
Immediate Actions Required
- Upgrade Apache Qpid ProtonJ2 to version 1.2.0 or later in all affected services and rebuild dependent applications.
- Inventory Java applications for transitive dependencies on ProtonJ2 <= 1.1.0 using build tooling such as mvn dependency:tree or gradle dependencies.
- Restrict AMQP endpoints to trusted, authenticated clients and revoke credentials for any accounts not required for messaging.
Patch Information
Apache has fixed this issue in Apache Qpid ProtonJ2 1.2.0, which introduces governance over the maximum number of transfer frames permitted per incoming delivery. Users of any version through 1.1.0 should upgrade to 1.2.0. Refer to the Apache Mailing List Discussion for maintainer guidance and the Openwall OSS Security Update for the coordinated advisory.
Workarounds
- Place AMQP services behind a reverse proxy or broker that enforces per-connection frame and bandwidth limits until the ProtonJ2 upgrade is deployed.
- Apply strict authentication and authorization policies so only vetted producers can open links against sensitive receivers.
- Configure JVM resource limits and container memory ceilings to contain the blast radius of a single resource-exhaustion attempt.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
