CVE-2026-66274 is a high-severity (CVSS 7.5) CWE-674 vulnerability in org.apache.qpid:proton-j. A fix is available for org.apache.qpid:proton-j — see the affected versions and patch details below.
Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.apache.qpid:proton-jReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.
This issue affects Apache Qpid Proton-J: through 0.34.1.
Users are recommended to upgrade to version 0.35.0, which fixes the issue.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.apache.qpid:proton-j | all versions | 0.35.0org.apache.qpid:proton-j:0.35.0 |
Affected Products
qpid proton-japacheDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.apache.qpid:proton-j, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update org.apache.qpid:proton-j to 0.35.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-66274 is resolved across your whole dependency graph.
Workarounds
Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is rated as Important as a remote, unauthenticated attacker can trigger a denial of service in Apache Qpid Proton-J. By sending specially crafted messages with unbounded type nesting, an attacker can cause a StackOverflowError, leading to service unavailability without requiring prior authentication…
To mitigate this issue, restrict network access to services utilizing Apache Qpid Proton-J to trusted clients and networks only. Implement firewall rules to limit inbound connections to the specific ports used by these services. This operational control reduces the attack surface by preventing untrusted external access, but may impact legitimate client connectivity if not carefully configured.Source: Red Hat security advisory for CVE-2026-66274 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| AMQ Clients 2026.Q3 | proton-j | RHSA-2026:69459 |
| Red Hat AMQ Broker 7.13.6 | amq-broker-bin.zip | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | amq-broker-bin.zip | RHSA-2026:66488 |
| Red Hat Build of Apache Camel 3.33.3.SP1 | org.apache.qpid/proton-j:0.35.0.redhat-00001 | RHSA-2026:63302 |
| Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16 | rhaf-camel-for-springboot-maven-repository.zip | RHSA-2026:71675 |
| Red Hat build of Quarkus 3.27.5.SP1 | org.apache.qpid/proton-j:0.35.0.redhat-00001 | RHSA-2026:62515 |
| Red Hat build of Quarkus 3.33.3.SP1 | org.apache.qpid/proton-j:0.35.0.redhat-00001 | RHSA-2026:62555 |
| Red Hat JBoss Enterprise Application Platform 8.1 | proton-j | RHSA-2026:95221 |
Frequently Asked Questions
Is CVE-2026-66274 in your dependencies?
Find it across Maven, including transitive dependencies.