CVE-2026-67591: Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid ProtonJ2to a version that resolves this vulnerability.Fixed in 1.2.0Patch CVE-2026-67591
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67591?
CVE-2026-67591 has a risk rating of 23, indicating a significant security vulnerability.
What impact does CVE-2026-67591 have?
CVE-2026-67591 allows an authenticated attacker to potentially exceed the session flow control window, leading to a denial of service.
Which versions of Apache Qpid ProtonJ2 are affected by CVE-2026-67591?
CVE-2026-67591 affects Apache Qpid ProtonJ2 versions up to and including 1.1.0.
How do I fix CVE-2026-67591?
To fix CVE-2026-67591, users should upgrade to Apache Qpid ProtonJ2 version 1.2.0 or later.
When was CVE-2026-67591 published?
CVE-2026-67591 was published on August 4, 2026.