CVE-2026-67589
published 2026-08-05CVE-2026-67589: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.49%
40.7th percentile
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | qpid_protonj2 | < 1.2.0 | 1.2.0 |
| apache_software_foundation | apache_qpid_protonj2 | <= 1.1.0 | — |
| apache_software_foundation | apache_qpid_protonj2 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
ghsa_unreviewed·2026-08-05
CVE-2026-67589 CWE-789 A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
VulDB
Apache Qpid ProtonJ2 up to 1.1.0 allocation of resources (EUVD-2026-53035 / Nessus ID 332250)
vuldb·2026-08-05
CVE-2026-67589 [LOW] Apache Qpid ProtonJ2 up to 1.1.0 allocation of resources (EUVD-2026-53035 / Nessus ID 332250)
A vulnerability was found in Apache Qpid ProtonJ2 up to 1.1.0. It has been classified as problematic. Affected by this issue is some unknown functionality. Performing a manipulation results in allocation of resources.
This vulnerability was named CVE-2026-67589. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
Red Hat
org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation
vendor_redhat·2026-08-05·CVSS 7.5
CVE-2026-67589 [HIGH] CWE-770 org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation
org.apache.qpid/protonj2: Apache Qpid ProtonJ2: Denial of Service via excessive memory allocation
A flaw was found in Apache Qpid ProtonJ2. A remote, unauthenticated attacker could exploit a vulnerability in the handling of type sizes and counts, leading to excessive memory allocation. This could result in a denial of service (DoS), making the affected system unavailable to legitimate users.
Package: protonj2 (Red Hat AMQ Clients) - Affected
No detection rules found.
No public exploits indexed.
2026-08-05
Published