CVE-2026-67555

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.

Users are recommended to upgrade to version 1.1.0, which fixes the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-675587.4The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE adverti CVE-2026-67567.5Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.CVE-2026-675607.5Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can CVE-2026-675679.9A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmR CVE-2026-675689.1The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected host CVE-2026-67576.3Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, CVE-2026-675774.3Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limite CVE-2026-675787.5FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the CVE-2026-675797.4Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through CVE-2026-67587.5Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.CVE-2026-675817.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one CVE-2026-675858.7Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthe_federation allows an unauthenticated remote attack