PatchTheCVEqpid protonj2 vulnerabilities and fixes
Recent CVEs affecting qpid protonj2, with upgrade or downgrade steps. 5 tracked.
Also searched as: qpidprotonj2.
qpid protonj2 has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-05. Highest priority: CVE-2026-67588 (score 50/100).
- CVE-2026-67588 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
- CVE-2026-67589 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
- CVE-2026-67590 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
- CVE-2026-67592 HIGH 7.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
- CVE-2026-67591 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
FAQ
How do I fix qpid protonj2 vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is qpid protonj2 being exploited right now?
None of the tracked qpid protonj2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which qpid protonj2 CVE should I patch first?
CVE-2026-67588 currently ranks highest (50/100): A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi.