CVE-2026-67551
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. Affects Apache Qpid Proton-Dotnet through 1.0.0.
Risk Assessment
The attack can cause excessive memory consumption, leading to system slowdown or crash.
Recommendation
Upgrade Apache Qpid Proton-Dotnet to version 1.1.0, which fixes the issue.
Other vulnerabilities in Apache Qpid Proton-Dotnet
See all- CVE-2026-67555Medium
In Apache Qpid Proton-Dotnet through 1.0.0, there is no limit on the maximum number of transfer frames per incoming delivery. An authenticated attacker can cause excessive resource usage and potential denial of service.
- CVE-2026-67554Medium
In Apache Qpid Proton-Dotnet through 1.0.0, an authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.
- CVE-2026-67553Medium
In Apache Qpid Proton-Dotnet through 1.0.0, an authenticated attacker can exceed the session flow control incoming window, potentially leading to denial of service.
- CVE-2026-67552High
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.
- CVE-2026-67465High
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. Affects Apache Qpid Proton-Dotnet through 1.0.0.
Original NVD description (English source)
pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.