CVE-2026-66273

Published: Aug 5, 2026Modified: Aug 7, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.

Affected (1)

Products: Apache: Qpid Proton J

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Qpid Proton J	Before 0.35.0

Related CWEs

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (2)

https://lists.apache.org/thread/z34s9v5w05qk4qqtz5fs3v9wpxz6fnbh

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/08/04/9

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.