CVE-2026-66276
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.42%
- CWE
- CWE-606
- Published
- 2026-08-05
- Last modified
- 2026-08-06
Affected products
- Apache Software Foundation Apache Qpid Proton-J
Weakness type
Related vulnerabilities
- CVE-2026-85730 — smol-toml: Denial of Service via malformed TOML documents
- CVE-2026-13761 — Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
- CVE-2026-16599 — Denial of Service in GNU wget
- CVE-2026-62901 — .NET Denial of Service Vulnerability
- CVE-2026-71439 — Mermaid radar diagrams are vulnerable to DoS
- CVE-2026-20301 — Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
- CVE-2026-67554 — Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service
- CVE-2026-68077 — Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service