CVE-2026-66273 Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
A pre-authentication attacker can cause excessive memory allocation leading to denial of service in Apache Qpid Proton-J.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66273?
CVE-2026-66273 is a high-severity denial of service vulnerability in Apache Qpid Proton-J, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Weakness: CWE-789
Which versions are affected by CVE-2026-66273?
It affects 1 product.
Products include Apache Qpid Proton-J.
How do I fix CVE-2026-66273?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-66273 being exploited?
There is no known exploitation of CVE-2026-66273 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Proton-J
- CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-66274 Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2018-17187 Improper Certificate Validation in proton-j
- CVE-2026-66275 Apache Qpid Proton-J: Incoming session flow control window can be exceeded
- CVE-2026-66276 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service
Sources
Also known as CLEANSTART-2026-YD02167, GHSA-wr2r-m36x-734x.