Vulnerability Details CVE-2026-66276
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 34.8%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-66276
-
cpe:2.3:a:apache:qpid_proton-j:0.1
-
cpe:2.3:a:apache:qpid_proton-j:0.10
-
cpe:2.3:a:apache:qpid_proton-j:0.11.0
-
cpe:2.3:a:apache:qpid_proton-j:0.11.1
-
cpe:2.3:a:apache:qpid_proton-j:0.12.0
-
cpe:2.3:a:apache:qpid_proton-j:0.12.1
-
cpe:2.3:a:apache:qpid_proton-j:0.12.2
-
cpe:2.3:a:apache:qpid_proton-j:0.13.0
-
cpe:2.3:a:apache:qpid_proton-j:0.13.1
-
cpe:2.3:a:apache:qpid_proton-j:0.14.0
-
cpe:2.3:a:apache:qpid_proton-j:0.15.0
-
cpe:2.3:a:apache:qpid_proton-j:0.16.0
-
cpe:2.3:a:apache:qpid_proton-j:0.17.0
-
cpe:2.3:a:apache:qpid_proton-j:0.18.0
-
cpe:2.3:a:apache:qpid_proton-j:0.19.0
-
cpe:2.3:a:apache:qpid_proton-j:0.2
-
cpe:2.3:a:apache:qpid_proton-j:0.20.0
-
cpe:2.3:a:apache:qpid_proton-j:0.21.0
-
cpe:2.3:a:apache:qpid_proton-j:0.22.0
-
cpe:2.3:a:apache:qpid_proton-j:0.23.0
-
cpe:2.3:a:apache:qpid_proton-j:0.24.0
-
cpe:2.3:a:apache:qpid_proton-j:0.25.0
-
cpe:2.3:a:apache:qpid_proton-j:0.26.0
-
cpe:2.3:a:apache:qpid_proton-j:0.27.0
-
cpe:2.3:a:apache:qpid_proton-j:0.27.1
-
cpe:2.3:a:apache:qpid_proton-j:0.27.2
-
cpe:2.3:a:apache:qpid_proton-j:0.27.3
-
cpe:2.3:a:apache:qpid_proton-j:0.28.0
-
cpe:2.3:a:apache:qpid_proton-j:0.28.1
-
cpe:2.3:a:apache:qpid_proton-j:0.29.0
-
cpe:2.3:a:apache:qpid_proton-j:0.3
-
cpe:2.3:a:apache:qpid_proton-j:0.30.0
-
cpe:2.3:a:apache:qpid_proton-j:0.31.0
-
cpe:2.3:a:apache:qpid_proton-j:0.32.0
-
cpe:2.3:a:apache:qpid_proton-j:0.33.0
-
cpe:2.3:a:apache:qpid_proton-j:0.33.1
-
cpe:2.3:a:apache:qpid_proton-j:0.33.10
-
cpe:2.3:a:apache:qpid_proton-j:0.33.2
-
cpe:2.3:a:apache:qpid_proton-j:0.33.3
-
cpe:2.3:a:apache:qpid_proton-j:0.33.4
-
cpe:2.3:a:apache:qpid_proton-j:0.33.5
-
cpe:2.3:a:apache:qpid_proton-j:0.33.6
-
cpe:2.3:a:apache:qpid_proton-j:0.33.7
-
cpe:2.3:a:apache:qpid_proton-j:0.33.8
-
cpe:2.3:a:apache:qpid_proton-j:0.33.9
-
cpe:2.3:a:apache:qpid_proton-j:0.34.0
-
cpe:2.3:a:apache:qpid_proton-j:0.34.1
-
cpe:2.3:a:apache:qpid_proton-j:0.4
-
cpe:2.3:a:apache:qpid_proton-j:0.5
-
cpe:2.3:a:apache:qpid_proton-j:0.6
-
cpe:2.3:a:apache:qpid_proton-j:0.7
-
cpe:2.3:a:apache:qpid_proton-j:0.8
-
cpe:2.3:a:apache:qpid_proton-j:0.9
-
cpe:2.3:a:apache:qpid_proton-j:0.9.1