GHSA-p2gc-fm5w-94jj

Suggest an improvement
Source
https://github.com/advisories/GHSA-p2gc-fm5w-94jj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p2gc-fm5w-94jj
Aliases
Downstream
CGA (8)
Published
2026-08-05T09:31:15Z
Modified
2026-11-03T21:45:42Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
Details

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T21:32:39Z",
    "nvd_published_at": "2026-08-05T07:16:37Z",
    "severity": "HIGH"
}
References

Affected packages

Maven / org.apache.qpid:proton-j

Package

Name
org.apache.qpid:proton-j
View open source insights on deps.dev
Purl
pkg:maven/org.apache.qpid/proton-j

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.35.0

Affected versions

0.*
0.4
0.5
0.6
0.7
0.8
0.9
0.9.1
0.10
0.11.0
0.11.1
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.20.0
0.21.0
0.22.0
0.23.0
0.24.0
0.25.0
0.26.0
0.27.0
0.27.1
0.27.2
0.27.3
0.28.0
0.28.1
0.29.0
0.30.0
0.31.0
0.32.0
0.33.0
0.33.1
0.33.2
0.33.3
0.33.4
0.33.5
0.33.6
0.33.7
0.33.8
0.33.9
0.33.10
0.34.0
0.34.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p2gc-fm5w-94jj/GHSA-p2gc-fm5w-94jj.json"