High
qpid-proton — security advisory
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.
- Products
- qpid-proton
- Affected versions
- 0.10-2, 0.14.0-5.1, 0.14.0-5.1ubuntu1, 0.22.0-3.2, 0.22.0-3.2build1, 0.22.0-3.3, 0.22.0-3.3build1, 0.22.0-5.1, 0.22.0-5.1build1, 0.22.0-5.1ubuntu1, 0.22.0-5.1ubuntu2, 0.37.0-2build1, 0.37.0-2build2, 0.37.0-2build4, 0.37.0-2build5, 0.37.0-6, 0.37.0-6build1, 0.37.0-7, 0.37.0-7build1, 0.37.0-8, 0.37.0-9, 0.37.0-9build1, 0.7-2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-67589
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:14 UTC · Revision 1
Source evidence
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.
osv:UBUNTU-CVE-2026-67589
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
qpid-proton
Fixed versions: Not specified
Complete source record
{
"id": "88cbb5c0c8cdecf2bac8cf354c9519c58ba6b48a8b47d9fd2f1834f26ee50a78",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-67589",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-67589",
"summary": "A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.",
"evidence": "osv:UBUNTU-CVE-2026-67589",
"products": [
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.7-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.10-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.14.0-5.1",
"evidence": "/affected/1/versions"
},
{
"value": "0.14.0-5.1ubuntu1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.22.0-3.2",
"evidence": "/affected/2/versions"
},
{
"value": "0.22.0-3.2build1",
"evidence": "/affected/2/versions"
},
{
"value": "0.22.0-3.3",
"evidence": "/affected/2/versions"
},
{
"value": "0.22.0-3.3build1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.22.0-5.1",
"evidence": "/affected/3/versions"
},
{
"value": "0.22.0-5.1build1",
"evidence": "/affected/3/versions"
},
{
"value": "0.22.0-5.1ubuntu1",
"evidence": "/affected/3/versions"
},
{
"value": "0.22.0-5.1ubuntu2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.37.0-2build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.37.0-2build2",
"evidence": "/affected/4/versions"
},
{
"value": "0.37.0-2build4",
"evidence": "/affected/4/versions"
},
{
"value": "0.37.0-2build5",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.37.0-7build1",
"evidence": "/affected/5/versions"
},
{
"value": "0.37.0-8",
"evidence": "/affected/5/versions"
},
{
"value": "0.37.0-9",
"evidence": "/affected/5/versions"
},
{
"value": "0.37.0-9build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "qpid-proton",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.37.0-6",
"evidence": "/affected/6/versions"
},
{
"value": "0.37.0-6build1",
"evidence": "/affected/6/versions"
},
{
"value": "0.37.0-7",
"evidence": "/affected/6/versions"
},
{
"value": "0.37.0-7build1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-67589",
"aliases": [
"UBUNTU-CVE-2026-67589"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.7-2",
"0.10-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton2",
"binary_version": "0.10-2"
},
{
"binary_name": "libqpid-proton2-dev-examples",
"binary_version": "0.10-2"
},
{
"binary_name": "python-qpid-proton",
"binary_version": "0.10-2"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.10-2"
},
{
"binary_name": "qpid-proton-dump",
"binary_version": "0.10-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"0.14.0-5.1",
"0.14.0-5.1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp8",
"binary_version": "0.14.0-5.1ubuntu1"
},
{
"binary_name": "libqpid-proton8",
"binary_version": "0.14.0-5.1ubuntu1"
},
{
"binary_name": "libqpid-proton8-dev-examples",
"binary_version": "0.14.0-5.1ubuntu1"
},
{
"binary_name": "python-qpid-proton",
"binary_version": "0.14.0-5.1ubuntu1"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.14.0-5.1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"0.22.0-3.2",
"0.22.0-3.2build1",
"0.22.0-3.3",
"0.22.0-3.3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp12",
"binary_version": "0.22.0-3.3build1"
},
{
"binary_name": "libqpid-proton11",
"binary_version": "0.22.0-3.3build1"
},
{
"binary_name": "libqpid-proton11-dev-examples",
"binary_version": "0.22.0-3.3build1"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.22.0-3.3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.22.0-5.1",
"0.22.0-5.1build1",
"0.22.0-5.1ubuntu1",
"0.22.0-5.1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp12",
"binary_version": "0.22.0-5.1ubuntu2"
},
{
"binary_name": "libqpid-proton11",
"binary_version": "0.22.0-5.1ubuntu2"
},
{
"binary_name": "libqpid-proton11-dev-examples",
"binary_version": "0.22.0-5.1ubuntu2"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.22.0-5.1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.37.0-2build1",
"0.37.0-2build2",
"0.37.0-2build4",
"0.37.0-2build5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp12",
"binary_version": "0.37.0-2build5"
},
{
"binary_name": "libqpid-proton11",
"binary_version": "0.37.0-2build5"
},
{
"binary_name": "libqpid-proton11-dev-examples",
"binary_version": "0.37.0-2build5"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.37.0-2build5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.37.0-7build1",
"0.37.0-8",
"0.37.0-9",
"0.37.0-9build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp12",
"binary_version": "0.37.0-9build1"
},
{
"binary_name": "libqpid-proton11",
"binary_version": "0.37.0-9build1"
},
{
"binary_name": "libqpid-proton11-dev-examples",
"binary_version": "0.37.0-9build1"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.37.0-9build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "qpid-proton",
"purl": "pkg:deb/ubuntu/qpid-proton?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.37.0-6",
"0.37.0-6build1",
"0.37.0-7",
"0.37.0-7build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-67589.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libqpid-proton-cpp12",
"binary_version": "0.37.0-7build1"
},
{
"binary_name": "libqpid-proton11",
"binary_version": "0.37.0-7build1"
},
{
"binary_name": "libqpid-proton11-dev-examples",
"binary_version": "0.37.0-7build1"
},
{
"binary_name": "python3-qpid-proton",
"binary_version": "0.37.0-7build1"
}
]
}
}
],
"modified": "2026-10-17T13:00:40.108611178Z",
"provider": "osv",
"upstream": [
"CVE-2026-67589"
],
"references": [
"https://ubuntu.com/security/CVE-2026-67589",
"https://www.cve.org/CVERecord?id=CVE-2026-67589",
"https://lists.apache.org/thread/bs24x4778dh72xtfs299cy8krvdlo47q"
]
},
"related_cves": [
{
"value": "CVE-2026-67589",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360771,
"published_at": "2026-08-05T06:16:00+00:00"
}