CVE-2026-67592

CVE-2026-67592 in Qpid ProtonJ2 allows an authenticated attacker to trigger memory exhaustion via unbounded transfer frames on a single AMQP delivery. The critical nuance is that authentication occurs once at connection establishment, not per-delivery—so this isn't an external denial-of-service vector requiring repeated connection attempts. A single authenticated session can concentrate all resource consumption into one delivery object, potentially bypassing per-connection or per-channel throttles designed to limit delivery multiplicity rather than per-delivery volume. This reframes the vulnerability as an intra-session abuse case rather than a classic DoS. If an attacker already has valid AMQP credentials, the question becomes: what additional harm does unbounded frame-count actually enable compared to simply flooding with legitimate deliveries? The answer lies in memory concentration—one malicious delivery can consume memory in ways that don't trigger controls targeting high-volume but legitimate traffic patterns. The CVSS 7.5 with EPSS 0.00329 reveals a notable gap: low exploitation probability doesn't indicate difficult weaponization but rather that attackers have easier targets. More concerning is what the disclosure doesn't capture—the real blast radius extends through every dependent service waiting on that queue, every retry circuit that piles on, and potentially every in-flight acknowledgment that evaporates when the channel resets. This can cross from availability impact into data integrity territory (message loss/duplication). The 1.2.0 fix adds a configurable limit, which introduces a forward security risk: operators will face pressure to raise the limit whenever legitimate large messages hit the ceiling, recreating the same unbounded-consumption pattern under operational pressure. Treat the default as your security boundary and audit any configuration changes. Prioritize patching on shared-secret or un-TLS-hardened deployments where 'authenticated attacker' describes a far larger threat surface than the CVE assumes.

Reviewed through automated stages and approved by a human before publication.