Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-05T05:42:30 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via uncontrolled transfer frames 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-770

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by sending an excessive number of transfer frames, leading to uncontrolled resource usage and a potential denial of service (DoS). This vulnerability arises because the system does not properly govern the maximum number of transfer frames per incoming delivery.

Red Hat AMQ Broker 7 Fix deferred amq-broker-bin.zip Red Hat AMQ Broker 7 Fix deferred amq-broker-maven-repository.zip Red Hat AMQ Clients Fix deferred proton-j Red Hat build of Apache Camel 4 for Quarkus 3 Fix deferred proton-j Red Hat build of Apache Camel for Spring Boot 4 Fix deferred rhaf-camel-for-springboot-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Fix deferred rhaf-camel-maven-repository.zip Red Hat build of Apache Camel for Spring Boot 4 Fix deferred rhaf-camel-spring-boot-maven-repository.zip Red Hat build of Quarkus Fix deferred proton-j Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred proton-j https://www.cve.org/CVERecord?id=CVE-2026-66277 https://nvd.nist.gov/vuln/detail/CVE-2026-66277 https://lists.apache.org/thread/48tflr3sx0sxq9bcdy5rh06oy3gmwx02