CVE-2026-66275: Apache Qpid Proton-J: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Proton-Jto a version that resolves this vulnerability.Fixed in 0.35.0Patch CVE-2026-66275
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66275?
The severity of CVE-2026-66275 is rated at risk level 23.
How do I fix CVE-2026-66275?
To fix CVE-2026-66275, users should upgrade to Apache Qpid Proton-J version 0.35.0 or higher.
What impact does CVE-2026-66275 have on my system?
CVE-2026-66275 can lead to a denial of service due to an authenticated attacker exceeding the session flow control window.
Which versions of Apache Qpid Proton-J are affected by CVE-2026-66275?
CVE-2026-66275 affects Apache Qpid Proton-J versions up to and including 0.34.1.
Is authentication required to exploit CVE-2026-66275?
Yes, an attacker must be authenticated to exploit CVE-2026-66275.