Bug 2511340 (CVE-2026-66277)

Summary: CVE-2026-66277 org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via uncontrolled transfer frames
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ant, anujha, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bstansbe, cescoffi, dandread, dbruscin, dkreling, dlofthou, ehugonne, fmariani, fmongiar, gmalinko, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jnethert, jwon, kaycoth, kvanderr, lthon, manderse, mcarlett, mosmerov, msvehla, nwallace, olubyans, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rruss, rstancel, rstepani, rsvoboda, sbiarozk, tcunning, thjenkin, tqvarnst, vdosoudi, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by sending an excessive number of transfer frames, leading to uncontrolled resource usage and a potential denial of service (DoS). This vulnerability arises because the system does not properly govern the maximum number of transfer frames per incoming delivery.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-05 07:01:25 UTC 
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.