CVE-2026-66277

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66277
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66277.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66277
Published
2026-08-05T05:42:30.115Z
Modified
2026-08-12T03:51:40.113802078Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery
Details

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66277.json",
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "0.34.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "0.34.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/qpid-proton-j

Affected ranges

Type
GIT
Repo
https://github.com/apache/qpid-proton-j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
743eecb20a8d7592d953147984c3e84b9d05b070
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:qpid_proton-j:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.35.0"
        }
    ]
}

Affected versions

0.*
0.17.0
0.18.0
0.19.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.0-rc1
0.27.0-rc2
0.27.1
0.28.0
0.28.1
0.29.0
0.30.0
0.31.0
0.32.0
0.33.0
0.33.1
0.33.10
0.33.2
0.33.3
0.33.4
0.33.5
0.33.6
0.33.7
0.33.8
0.33.9
0.34.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66277.json"