Live › vulnerability › CVE-2026-66274
Apache Qpid Proton-J, a Java library for the AMQP messaging protocol, does not limit how deeply AMQP types can be nested. A remote attacker can send a crafted message before authenticating to trigger a StackOverflowError, which can take the service down (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:35 UTC, 1h before NVD. All times on this page are UTC.
Applications that embed proton-j 0.34.1 or earlier and accept AMQP connections, such as messaging clients or brokers, are exposed. The flaw is reachable before authentication, so any service that exposes the AMQP port to untrusted peers is at risk; applications that only use proton-j for outbound connections to trusted brokers are less exposed. The sources do not say which products bundle the library.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.qpid:proton-j | maven | < 0.35.0 | 0.35.0 |
| apache qpid proton-j | vendor | < 0.35.0 | 0.35.0 |
mvn dependency:tree | grep proton-j).org.apache.qpid:proton-j 0.35.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-66274")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.