{"id":"CVE-2026-66274","kind":"vulnerability","aliases":["CVE-2026-66274","GHSA-p2gc-fm5w-94jj"],"related":[],"title":"Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow","description":"A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.\n\nThis issue affects Apache Qpid Proton-J: through 0.34.1.\n\nUsers are recommended to upgrade to version 0.35.0, which fixes the issue.","summary":"Apache Qpid Proton-J, a Java library for the AMQP messaging protocol, does not limit how deeply AMQP types can be nested. A remote attacker can send a crafted message before authenticating to trigger a StackOverflowError, which can take the service down (denial of service).","severity":"high","cvss":7.5,"epss":0.00774,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.qpid:proton-j","fixed":["0.35.0"],"affected":"< 0.35.0","ecosystem":"maven"},{"name":"apache qpid proton-j","fixed":["0.35.0"],"affected":"< 0.35.0","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["amqp","cwe-674","java","maven","messaging","package"],"not_affected_if":["no-untrusted-amqp-listener","proton-j-0.35.0-or-later"],"how_to_check":"- Check the proton-j version in your build file or dependency tree (for example `mvn dependency:tree | grep proton-j`).\n- Confirm whether a service using it accepts AMQP connections from untrusted networks.","fix":"- `org.apache.qpid:proton-j` `0.35.0`","status":"open","published_at":"2026-08-05T07:16:37+00:00","first_seen_at":"2026-11-03T21:35:15+00:00","triaged_at":"2026-11-03T21:38:52+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:38:52Z","model":"claude-haiku-5-5","output":{"fix":"- `org.apache.qpid:proton-j` `0.35.0`","reach":"network","title":"Apache Qpid Proton-J: unbounded type nesting crashes AMQP service before login","impact":"low","summary":"Apache Qpid Proton-J, a Java library for the AMQP messaging protocol, does not limit how deeply AMQP types can be nested. A remote attacker can send a crafted message before authenticating to trigger a StackOverflowError, which can take the service down (denial of service).","audience":"developers","category":"package","nicknames":[],"who_cares":["java","maven","amqp","messaging"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote crash of the service via stack overflow, denial of service","analyst_note":"","how_to_check":"- Check the proton-j version in your build file or dependency tree (for example `mvn dependency:tree | grep proton-j`).\n- Confirm whether a service using it accepts AMQP connections from untrusted networks.","plain_action":"","needs_analyst":false,"not_affected_if":["proton-j-0.35.0-or-later","no-untrusted-amqp-listener"],"who_is_affected":"Applications that embed proton-j 0.34.1 or earlier and accept AMQP connections, such as messaging clients or brokers, are exposed. The flaw is reachable before authentication, so any service that exposes the AMQP port to untrusted peers is at risk; applications that only use proton-j for outbound connections to trusted brokers are less exposed. The sources do not say which products bundle the library.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4209,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A '-66274':18A,26A '-674':38B '0.34.1':117C '0.35.0':125C '94jj':23A 'affect':110C 'amqp':36B,53B,61B 'apach':1A,43B,111C 'apache':31A 'attack':68B,93C 'authent':14A,75B,92C 'caus':99C 'could':94C 'craft':72B 'cve':16A,24A 'cwe':37B 'deepli':60B 'denial':86B,105C 'fix':127C 'fm5w':22A 'ghsa':20A 'ghsa-p2gc-fm5w-94jj':19A 'issu':109C,129C 'j':5A,30A,35A,47B,115C 'java':39B,49B 'lead':10A,103C 'leverag':95C 'librari':50B 'limit':58B 'maven':40B 'messag':41B,54B,73B 'nest':8A,65B,97C 'org.apache.qpid':27A 'p2gc':21A 'packag':42B 'potenti':102C 'pre':13A,91C 'pre-authent':12A,90C 'protocol':55B 'proton':4A,29A,34A,46B,114C 'proton-j':3A,28A,33A,45B,113C 'qpid':2A,32A,44B,112C 'recommend':120C 'remot':67B 'send':70B 'servic':84B,88B,107C 'stackoverflow':15A 'stackoverflowerror':79B,101C 'take':82B 'trigger':77B 'type':7A,62B,96C 'unbound':6A 'upgrad':122C 'user':118C 'version':124C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed proton-j 0.34.1 or earlier and accept AMQP connections, such as messaging clients or brokers, are exposed. The flaw is reachable before authentication, so any service that exposes the AMQP port to untrusted peers is at risk; applications that only use proton-j for outbound connections to trusted brokers are less exposed. The sources do not say which products bundle the library.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["apacheqpidprotonj","orgapacheqpidprotonj","qpidprotonj"],"ptokens":["apache","org","proton","qpid"],"labels":["amqp","cwe674","high","java","maven","messaging","package","vendor"],"campaign_type":null,"first_public_at":"2026-08-05T07:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-p2gc-fm5w-94jj","url":"https://github.com/advisories/GHSA-p2gc-fm5w-94jj","severity":"high","published_at":"2026-08-05T09:31:15+00:00","modified_at":"2026-11-03T21:32:44+00:00","first_seen_at":"2026-11-03T21:35:15+00:00","fetched_at":"2026-11-03T21:52:03+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-66274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66274","severity":null,"published_at":"2026-08-05T07:16:37+00:00","modified_at":"2026-10-24T16:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":60980,"url":"https://github.com/apache/qpid-proton-j/commit/92047419cc87bab6220e7adeb354958d8109618e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60981,"url":"https://github.com/apache/qpid-proton-j/releases/tag/0.35.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":61059,"url":"https://lists.apache.org/thread/h7xolzws2by2qhdjf7scbx87foxojb5h","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":61060,"url":"http://www.openwall.com/lists/oss-security/2026/08/04/10","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}