Qpid Proton-j (Apache) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 86 known versions, newest CVE from 2026-08-05. Vendor: Apache.

CVEs of Qpid Proton-j

• CVE-2026-66277 - CVSS 6.5 (medium), 2026-08-05: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource…
• CVE-2026-66276 - CVSS 6.5 (medium), 2026-08-05: An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to…
• CVE-2026-66275 - CVSS 6.5 (medium), 2026-08-05: An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid…
• CVE-2026-66274 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache…
• CVE-2026-66273 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects…
• CVE-2026-66257 - CVSS 7.5 (high), 2026-08-05: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects…
• CVE-2018-17187 - CVSS 7.4 (high), 2018-11-13: The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a…