Read the docs
TI-2026-47091 Aliases CVE-2026-66274GHSA-p2gc-fm5w-94jj

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

Priority MEDIUM 40CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00774 55th percentileScored 2026-11-07
Fix Partial org.apache.qpid:proton-j (Maven): 0.35.0Red Hat: 8 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Qpid Proton-Jup to 0.34.1—No fix listedCNA
—org.apache.qpid:proton-j (Maven)before 0.35.00.35.0Patch availableGHSA-p2gc-fm5w-94jj
  • Apache Qpid Proton-J VendorApache Affected up to 0.34.1 Fixed in — No fix listed CNA
  • org.apache.qpid:proton-j (Maven) Vendor— Affected before 0.35.0 Fixed in 0.35.0 Patch available GHSA-p2gc-fm5w-94jj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:qpid_proton-j:*:*:*:*:*:*:*:*before 0.35.0VulnerableApache
  • cpe:2.3:a:apache:qpid_proton-j:*:*:*:*:*:*:*:* Versions before 0.35.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-p2gc-fm5w-94jj org.apache.qpid:proton-j (Maven) Fixed in 0.35.0 Advisory →

Red Hat 8 advisories

  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
  • RHSA-2026:69459 Released 2026-09-21 · Red Hat rating Important
    AMQ Clients 2026.Q3
    • AMQ Clients 2026.Q3
Show 5 more Red Hat advisories
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
AMQ Clients 2026.Q3Fixed RHSA-2026:69459
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 3 products
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-66274
  2. 2026-10-03 Alias added: GHSA-p2gc-fm5w-94jj
  3. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  4. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1, Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
  7. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
  8. 2026-10-20 Affected versions changed · Red Hat
  9. 2026-11-03 Fix available: Maven/org.apache.qpid:[email protected] · GHSA-p2gc-fm5w-94jj
  10. 2026-11-03 CVSS score added · GHSA-p2gc-fm5w-94jj
  11. 2026-11-03 Weakness changed · GHSA-p2gc-fm5w-94jj
  12. 2026-11-03 6 new references · GHSA-p2gc-fm5w-94jj
  13. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  14. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat

References

Advisory 3

Other 3

  • TI-2026-47090 Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication CVSS 3.1HIGH 7.5
  • TI-2026-47085 Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2018-12286 Improper certificate validation in Apache Qpid Proton-J CVSS 3.0HIGH 7.4
  • TI-2026-47094 Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery CVSS 3.1MEDIUM 6.5
  • TI-2026-47093 Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service CVSS 3.1MEDIUM 6.5
  • TI-2026-47092 Apache Qpid Proton-J: Incoming session flow control window can be exceeded CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences