Apache Software Foundation Apache Qpid Proton-J
7 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-66277 | ≤ 0.34.1 | Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-66276 | ≤ 0.34.1 | Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-66275 | ≤ 0.34.1 | Apache Qpid Proton-J: Incoming session flow control window can be exceeded | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-66274 | ≤ 0.34.1 | Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow | HIGH 7.5 | 0.8 % | ||
| CVE-2026-66273 | ≤ 0.34.1 | Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication | HIGH 7.5 | 0.8 % | ||
| CVE-2026-66257 | ≤ 0.34.1 | Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion | HIGH 7.5 | 0.8 % | ||
| CVE-2018-17187 | Apache Qpid Proton-J 0.3 to 0.29.0 | The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Un | HIGH 7.4 | 2.5 % |