CVE-2026-66275
published 2026-08-05CVE-2026-66275: An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
35.4th percentile
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_proton-j | < 0.35.0 | 0.35.0 |
| apache | qpid_proton-j | — | — |
| apache_software_foundation | apache_qpid_proton-j | <= 0.34.1 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Qpid Proton-J up to 0.34.1 Session Flow Control Window allocation of resources
vuldb·2026-08-09·CVSS 6.5
CVE-2026-66275 [MEDIUM] Apache Qpid Proton-J up to 0.34.1 Session Flow Control Window allocation of resources
A vulnerability labeled as problematic has been found in Apache Qpid Proton-J up to 0.34.1. This impacts an unknown function of the component Session Flow Control Window. Executing a manipulation can lead to allocation of resources.
This vulnerability is tracked as CVE-2026-66275. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
GHSA
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
ghsa_unreviewed·2026-08-05
CVE-2026-66275 CWE-770 An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Red Hat
Apache Qpid Proton-J: Apache Qpid Proton-J: Denial of Service via exceeding session flow control window
vendor_redhat·2026-08-05·CVSS 6.5
CVE-2026-66275 [MEDIUM] CWE-770 Apache Qpid Proton-J: Apache Qpid Proton-J: Denial of Service via exceeding session flow control window
Apache Qpid Proton-J: Apache Qpid Proton-J: Denial of Service via exceeding session flow control window
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by exceeding the session flow control incoming window. This action could lead to a denial of service (DoS), making the system unavailable to legitimate users.
Statement: Red Hat ships Apache Qpid Proton-J in several middleware products. All affected versions are set to AFFECTED/DEFER as the CVSS score (6.5) is below the 7.0 threshold for immediate re
No detection rules found.
No public exploits indexed.
2026-08-05
Published