CVE-2026-67592
CVE-2026-67592 · Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue
CVSS 7.5 · High · EPSS 0.7%
- Published
- Updated
Stack: system
Affected products and versions
apache qpid protonj2
- Versions
- ≥ 0, ≤ 1.1.0: Affected (semver)
No fix published
qpid-proton Ubuntu:16.04:LTS
- Versions
- 0.7-2
- 0.10-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:18.04:LTS
- Versions
- 0.14.0-5.1
- 0.14.0-5.1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:20.04:LTS
- Versions
- 0.22.0-3.2
- 0.22.0-3.2build1
- 0.22.0-3.3
- 0.22.0-3.3build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:22.04:LTS
- Versions
- 0.22.0-5.1
- 0.22.0-5.1build1
- 0.22.0-5.1ubuntu1
- 0.22.0-5.1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:24.04:LTS
- Versions
- 0.37.0-2build1
- 0.37.0-2build2
- 0.37.0-2build4
- 0.37.0-2build5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:26.10
- Versions
- 0.37.0-7build1
- 0.37.0-8
- 0.37.0-9
- 0.37.0-9build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
qpid-proton Ubuntu:26.04:LTS
- Versions
- 0.37.0-6
- 0.37.0-6build1
- 0.37.0-7
- 0.37.0-7build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published