CVE-2026-67552
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.
Risk Assessment
The vulnerability could allow an unauthenticated attacker to crash the application using Proton-Dotnet, leading to service unavailability.
Recommendation
Upgrade Apache Qpid Proton-Dotnet to version 1.1.0 or later, which contains the fix.
Other vulnerabilities in Apache Qpid Proton-Dotnet
See all- CVE-2026-67555Medium
In Apache Qpid Proton-Dotnet through 1.0.0, there is no limit on the maximum number of transfer frames per incoming delivery. An authenticated attacker can cause excessive resource usage and potential denial of service.
- CVE-2026-67554Medium
In Apache Qpid Proton-Dotnet through 1.0.0, an authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.
- CVE-2026-67553Medium
In Apache Qpid Proton-Dotnet through 1.0.0, an authenticated attacker can exceed the session flow control incoming window, potentially leading to denial of service.
- CVE-2026-67551High
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. Affects Apache Qpid Proton-Dotnet through 1.0.0.
- CVE-2026-67465High
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. Affects Apache Qpid Proton-Dotnet through 1.0.0.
Original NVD description (English source)
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue