CVE-2026-66276

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.

This issue affects Apache Qpid Proton-J: through 0.34.1.

Users are recommended to upgrade to version 0.35.0, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-606

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Qpid Proton-J	<= 0.34.1

References

https://lists.apache.org/thread/14nj0lpsqpnd3q0hw0t0tw44qvdo1jc2Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/04/12Mailing List, Third Party Advisory

Timeline

Published: Aug 5, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-662776.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause exces CVE-2026-662797.2In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resultin CVE-2026-66286.3A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the compon CVE-2026-662816.0In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop)CVE-2026-662826.0In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its CVE-2026-66297.3A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the CVE-2026-662966.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the CVE-2026-662978.0Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows comma CVE-2026-662988.8Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard CVE-2026-662995.3Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M2 CVE-2026-66308.8A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSet CVE-2026-663005.0SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inje