High · 7.5 CVE-2026-67588 EUVD-2026-53054GHSA-mxmv-xrrq-hrv5

Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

Published Aug 5, 2026 · Updated Aug 6, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Qpid ProtonJ2 Package: qpid-proton Ecosystem: Ubuntu

Description

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

This issue affects Apache Qpid ProtonJ2: through 1.1.0.

Users are recommended to upgrade to version 1.2.0, which fixes the issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Qpid ProtonJ2	≤ 1.1.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	qpid-proton	No fix yet	—
Ubuntu 22.04 LTS	qpid-proton	No fix yet	—
Ubuntu 18.04 LTS	qpid-proton	No fix yet	—
Ubuntu 16.04 LTS	qpid-proton	No fix yet	—

References

https://lists.apache.org/thread/vk4j02dzggfdrdkwvzmqo4jro2tgj0jt vendor-advisory