CVE-2026-66276 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service
An authenticated attacker can cause denial of service in Apache Qpid Proton-J by sending crafted disposition frames with large ranges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-66276?
CVE-2026-66276 is a medium-severity denial of service vulnerability in Apache Qpid Proton-J, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Weakness: CWE-606
Which versions are affected by CVE-2026-66276?
It affects 1 product.
Products include Apache Qpid Proton-J.
How do I fix CVE-2026-66276?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-66276 being exploited?
There is no known exploitation of CVE-2026-66276 in the wild and no public exploit code.
Other vulnerabilities in Apache Qpid Proton-J
- CVE-2026-66257 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-66273 Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-66274 Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2018-17187 Improper Certificate Validation in proton-j
- CVE-2026-66275 Apache Qpid Proton-J: Incoming session flow control window can be exceeded
Sources
Also known as CLEANSTART-2026-JV92221, GHSA-jx9q-477g-4wgw.