CVE-2026-66274: Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Proton-Jto a version that resolves this vulnerability.Fixed in 0.35.0Patch CVE-2026-66274
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66274?
CVE-2026-66274 has a risk rating of 28, indicating it may pose a significant security threat.
How do I fix CVE-2026-66274?
To fix CVE-2026-66274, upgrade Apache Qpid Proton-J to version 0.35.0 or later.
What impact does CVE-2026-66274 have on my system?
CVE-2026-66274 could lead to a denial of service condition due to a StackOverflowError caused by unbounded type nesting.
Which versions of Apache Qpid Proton-J are affected by CVE-2026-66274?
CVE-2026-66274 affects Apache Qpid Proton-J versions up to and including 0.34.1.
Who is affected by CVE-2026-66274?
Users and administrators of Apache Qpid Proton-J versions prior to 0.35.0 are at risk of CVE-2026-66274.