CVE-2026-67551

CVE-2026-67551 is a type size/count handling vulnerability in Apache Qpid Proton-Dotnet, an AMQP 1.0 protocol library for .NET. Versions through 1.0.0 are vulnerable; upgrade to 1.1.0. The CVSS 7.5 score almost certainly underweights this vulnerability, and here's why that matters operationally. The vulnerability is pre-authentication and triggers during AMQP message parsing. In a messaging bus topology, a single broker node running this library can be exhausted by an unauthenticated peer, but the failure mode isn't a contained crash—it's backpressure propagation. Producers block, dependent services hit timeouts, and you get a distributed availability event requiring coordinated remediation across multiple services. The CVSS model treats this as a host-level DoS because it can't see architectural topology. In .NET contexts specifically, allocation exhaustion triggers non-linear garbage collection pause behavior. You won't see a clean OOM kill; you'll see GC storms, degraded throughput, and connection timeouts that cascade before an operator can intervene. This is a different operational signature from container restarts—it manifests as SLA violations on services that aren't even running the vulnerable code. The upgrade path to 1.1.0 requires scrutiny. If the patch implements allocation caps rather than structural bounds checking on nested type parsing, legitimate messages with deep type nesting will be rejected silently. Audit your message schemas for nesting depth before upgrading—if the cap triggers false positives, operators tend to disable the validation, which reintroduces the vulnerability as operational friction. Determine whether your deployment parses untrusted AMQP messages directly or uses the library purely as a client. If it's the former—inbound connection handling, peer-to-peer topologies, or relay configurations—the pre-auth vector applies. Many organizations won't have audited this configuration, and SBOM practices for .NET AMQP dependencies lag behind container-native environments. The remediation gap here isn't patch-to-install latency; it's CVE-to-awareness latency in a population that may not know this library is in their dependency tree.

Reviewed through automated stages and approved by a human before publication.