CVE-2026-66277: Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Proton-Jto a version that resolves this vulnerability.Fixed in 0.35.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66277?
CVE-2026-66277 has a risk rating of 26.
How do I fix CVE-2026-66277?
To mitigate CVE-2026-66277, users should upgrade Apache Qpid Proton-J to version 0.35.0 or later.
What type of vulnerability is CVE-2026-66277?
CVE-2026-66277 is a denial of service vulnerability that allows authenticated attackers to cause excessive resource usage.
Which versions of Apache Qpid Proton-J are affected by CVE-2026-66277?
CVE-2026-66277 affects Apache Qpid Proton-J versions up to and including 0.34.1.
Who is impacted by CVE-2026-66277?
Users of Apache Qpid Proton-J prior to version 0.35.0 are impacted by CVE-2026-66277.