CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
A pre-authentication attacker can cause resource exhaustion and denial of service via unbounded symbol value caching in Apache Qpid Proton-J.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66257?
CVE-2026-66257 is a high-severity denial of service vulnerability in Apache Qpid Proton-J, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Weakness: CWE-770
Which versions are affected by CVE-2026-66257?
It affects 1 product.
Products include Apache Qpid Proton-J.
How do I fix CVE-2026-66257?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-66257 being exploited?
There is no known exploitation of CVE-2026-66257 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Proton-J
- CVE-2026-66273 Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-66274 Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2018-17187 Improper Certificate Validation in proton-j
- CVE-2026-66275 Apache Qpid Proton-J: Incoming session flow control window can be exceeded
- CVE-2026-66276 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service
Sources
Also known as CLEANSTART-2026-KJ02957, GHSA-g4xc-w2cq-f2f8.