Apache Qpid Proton-J
7 CVEs affecting Apache Qpid Proton-J. Latest disclosed: 2026-08-05. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66274 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qp… |
CVE-2026-66273 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects… |
CVE-2026-66257 | High | 7.5 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apac… |
CVE-2018-17187 | High | 7.4 | 2018-11-13 | The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification… |
CVE-2026-66277 | Medium | 6.5 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage… |
CVE-2026-66276 | Medium | 6.5 | 2026-08-05 | An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial… |
CVE-2026-66275 | Medium | 6.5 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proto… |