Bug 2511351 (CVE-2026-66275)

Summary:	CVE-2026-66275 Apache Qpid Proton-J: Apache Qpid Proton-J: Denial of Service via exceeding session flow control window
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ant, anujha, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, bstansbe, cescoffi, dandread, dbruscin, dkreling, dlofthou, ehugonne, fmariani, fmongiar, gmalinko, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jnethert, jwon, kaycoth, kvanderr, lthon, manderse, mcarlett, mosmerov, msvehla, nwallace, olubyans, pberan, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rruss, rstancel, rstepani, rsvoboda, sbiarozk, tcunning, thjenkin, tqvarnst, vdosoudi, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by exceeding the session flow control incoming window. This action could lead to a denial of service (DoS), making the system unavailable to legitimate users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-05 07:01:53 UTC

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.