Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.qpid:proton-j

8 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
0.35.0 (Jul 31, 2026): no advisory affects it
Newest unaffected release
0.35.0 (Jul 31, 2026), the latest release
Advisories
8 · 3 high, 3 medium
Dependents
100
Releases
52 since 0.4 (Feb 21, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2026-66277Medium 6.5

    Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery

    Affected: through 0.34.1.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.35.0, is not affected.

  • CVE-2026-66276Medium 6.5

    Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service

    Affected: through 0.34.1.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.35.0, is not affected.

  • CVE-2026-66275Medium 6.5

    Apache Qpid Proton-J: Incoming session flow control window can be exceeded

    Affected: through 0.34.1.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.35.0, is not affected.

  • Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow

    Affected: through 0.34.1; fixed in 0.35.0.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure).

    The latest release, 0.35.0, is not affected.

  • Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication

    Affected: through 0.34.1.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.35.0, is not affected.

  • Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion

    Affected: through 0.34.1.

    Fixed in 0.35.0 (released Jul 31, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.35.0, is not affected.

  • The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods.

    Affected: from 0.3, fixed in 0.30.0.

    Fixed in 0.30.0 (released Nov 6, 2018, 7 days before disclosure).

    The latest release, 0.35.0, is not affected.

  • The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton…

    Affected: fixed in 0.12.1.

    Fixed in 0.12.1 (released Mar 17, 2016, 26 days before disclosure).

    The latest release, 0.35.0, is not affected.