Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-05T05:44:18 org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via uncontrolled incoming data transfers 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-770

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue

A flaw was found in Apache Qpid ProtonJ2. An authenticated attacker could exploit a vulnerability where the system fails to limit the number of incoming data transfers. This oversight allows the attacker to consume excessive system resources, potentially leading to a denial of service (DoS), which makes the system unavailable to legitimate users.

Red Hat AMQ Clients Fix deferred protonj2 https://www.cve.org/CVERecord?id=CVE-2026-67592 https://nvd.nist.gov/vuln/detail/CVE-2026-67592 https://lists.apache.org/thread/b4pv9hfdk7ox78pss77sb4nzwjrvqhhz