CVE-2026-67591
Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
CVE-2026-67591- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-53089
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
EUVD-2026-53089- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xcxh-hgpq-crj6
An authenticated attacker could exceed the session flow control incoming window potentially...
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
GHSA-xcxh-hgpq-crj6- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
CVE-2026-67591- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid ProtonJ2: through 1.1.0.
Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
CVE-2026-67591- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-67591
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
UBUNTU-CVE-2026-67591- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-67591 No score
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Record
DEBIAN-CVE-2026-67591- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qpid-protonUbuntu:16.04:LTS |
All versions, plus listed versions 0.7-20.10-2 |
None known |
qpid-protonUbuntu:18.04:LTS |
All versions, plus listed versions 0.14.0-5.10.14.0-5.1ubuntu1 |
None known |
qpid-protonUbuntu:20.04:LTS |
All versions, plus listed versions 0.22.0-3.20.22.0-3.2build10.22.0-3.30.22.0-3.3build1 |
None known |
qpid-protonUbuntu:22.04:LTS |
All versions, plus listed versions 0.22.0-5.10.22.0-5.1build10.22.0-5.1ubuntu10.22.0-5.1ubuntu2 |
None known |
qpid-protonUbuntu:24.04:LTS |
All versions, plus listed versions 0.37.0-2build10.37.0-2build20.37.0-2build40.37.0-2build5 |
None known |
qpid-protonUbuntu:26.10 |
All versions, plus listed versions 0.37.0-7build10.37.0-80.37.0-90.37.0-9build1 |
None known |
qpid-protonUbuntu:26.04:LTS |
All versions, plus listed versions 0.37.0-60.37.0-6build10.37.0-70.37.0-7build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-67591 is a medium vulnerability (CVSS 6.5) in Apache Qpid Protonj2, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. No source names a fixed version.
References
lists.apache.org/thread/rwmggh2bkm6qotxpdfcplht3jgw5n036
openwall.com/lists/oss-security/2026/08/04/30
nvd.nist.gov/vuln/detail/CVE-2026-67591
github.com/advisories/GHSA-xcxh-hgpq-crj6
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-67591
ubuntu.com/security/CVE-2026-67591
cve.org/CVERecord?id=CVE-2026-67591