Apache Qpid Proton-Dotnet DoS via session flow control (1.0.0)
CVE-2026-67553 Published on August 5, 2026
Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.
This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.
Users are recommended to upgrade to version 1.1.0, which fixes the issue.
Vulnerability Analysis
CVE-2026-67553 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Affected Versions
Apache Software Foundation Apache Qpid Proton Dotnet:- Before and including 1.0.0 is affected.