Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-67553: Apache Qpid Proton-Dotnet may be flooded causing service outage

CVE-2026-67553 · published 3 months ago

Summary

A user who has logged in can send more data than the system expects, which can overwhelm the server and stop it from working properly. This could result in a denial of service for legitimate users. Update Apache Qpid Proton-Dotnet to version 1.1.0 to resolve the issue.

What to do

Update apache qpid_proton-dotnet to version 1.1.0 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache qpid proton dotnet	<= 1.0.0
apache	qpid_proton-dotnet	< 1.1.0 `cpe:2.3:a:apache:qpid_proton-dotnet::::::::`

Original advisory text

Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.

This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.

Users are recommended to upgrade to version 1.1.0, which fixes the issue.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67553... Vendor Advisory
https://lists.apache.org/thread/hvsncmcbgjrn85crs909nf4y3dqqrywo Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-67553 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/04/24 URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published5 Aug 2026

Updated4 Nov 2026

First seen5 Aug 2026

Sources

CVE-2026-67553 · NVD

CVE-2026-67553 · MITRE

CVE-2026-67553 · OSV

Track software like this

Free during beta