CVE-2026-67591
CVE-2026-67591 · Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.
CVSS 6.5 · Medium · EPSS 0.7%
- Published
- Updated
Stack: system
Affected products and versions
apache qpid protonj2
- Versions
- ≥ 0, ≤ 1.1.0: Affected (semver)
No fix published
qpid-proton Ubuntu:16.04:LTS
- Versions
- 0.7-2
- 0.10-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:18.04:LTS
- Versions
- 0.14.0-5.1
- 0.14.0-5.1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:20.04:LTS
- Versions
- 0.22.0-3.2
- 0.22.0-3.2build1
- 0.22.0-3.3
- 0.22.0-3.3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:22.04:LTS
- Versions
- 0.22.0-5.1
- 0.22.0-5.1build1
- 0.22.0-5.1ubuntu1
- 0.22.0-5.1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:24.04:LTS
- Versions
- 0.37.0-2build1
- 0.37.0-2build2
- 0.37.0-2build4
- 0.37.0-2build5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:26.10
- Versions
- 0.37.0-7build1
- 0.37.0-8
- 0.37.0-9
- 0.37.0-9build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:26.04:LTS
- Versions
- 0.37.0-6
- 0.37.0-6build1
- 0.37.0-7
- 0.37.0-7build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published