It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://lists.apache.org/thread/dwrb02dp714lvlfxdj4o5bc9h3z54sw3 Mailing List, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · apacheNVD modified 2026-10-23 21:10
Affected (CPE criteria) 1
cpe:2.3:a:apache:qpid_proton-dotnet:*:*:*:*:*:*:*:*
References 2
- https://lists.apache.org/thread/dwrb02dp714lvlfxdj4o5bc9h3z54sw3 Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/08/04/26 Mailing List, Third Party Advisory