Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T05:29:44 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service.

This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication or complex attack prerequisites. To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured. Red Hat AMQ Broker 7 Affected amq-broker-bin.zip Red Hat AMQ Broker 7 Affected amq-broker-maven-repository.zip Red Hat AMQ Clients Affected proton-j Red Hat build of Apache Camel 4 for Quarkus 3 Affected proton-j Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-for-springboot-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Affected rhaf-camel-spring-boot-maven-repository.zip Red Hat build of Quarkus Affected proton-j Red Hat JBoss Enterprise Application Platform Expansion Pack Affected proton-j https://www.cve.org/CVERecord?id=CVE-2026-66274 https://nvd.nist.gov/vuln/detail/CVE-2026-66274 https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h