CVE-2026-67554
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.41%
- CWE
- CWE-606
- Published
- 2026-08-05
- Last modified
- 2026-08-05
Affected products
- Apache Software Foundation Apache Qpid Proton Dotnet
Weakness type
Related vulnerabilities
- CVE-2026-85730 — smol-toml: Denial of Service via malformed TOML documents
- CVE-2026-13761 — Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
- CVE-2026-16599 — Denial of Service in GNU wget
- CVE-2026-62901 — .NET Denial of Service Vulnerability
- CVE-2026-71439 — Mermaid radar diagrams are vulnerable to DoS
- CVE-2026-20301 — Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability
- CVE-2026-68077 — Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
- CVE-2026-66276 — Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service