Loading story…
Apache disclosed CVE-2026-67551 in Apache Qpid Proton-Dotnet, warning that improper handling of type size and count values can let an unauthenticated attacker trigger excessive memory allocation before authentication. The issue affects Apache Qpid Proton-Dotnet through version 1.0.0 and can be exploited to cause a denial of service by exhausting available memory.
The project rated the vulnerability important and released a fix in version 1.1.0. Organizations using Apache Qpid messaging components built on Proton-Dotnet are advised to identify exposed deployments and upgrade affected instances to 1.1.0 to mitigate the pre-authentication resource exhaustion risk.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Timothy A. Bish disclosed CVE-2026-67551 on August 4, 2026 via the oss-sec mailing list. The advisory said Apache Qpid Proton-Dotnet through version 1.0.0 is affected and recommended upgrading to version 1.1.0.
A security advisory stated that Apache Qpid Proton-Dotnet version 1.1.0 contains the fix for CVE-2026-67551, a type size/count handling flaw that could let a pre-authentication attacker trigger excessive memory allocation and potential denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed denial-of-service vulnerability dubbed **HTTP/2 Bomb** (`CVE-2026-49975`) can let unauthenticated attackers crash vulnerable servers by abusing HTTP/2 header compression and flow-control behavior to amplify small requests into large in-memory allocations. Researchers said the flaw affects widely deployed infrastructure including **nginx**, **Apache httpd**, **Microsoft IIS**, **Envoy**, and **Cloudflare Pingora**, with early Internet scans identifying more than **880,000** potentially exposed websites. Security firms reported reconnaissance activity in the wild, and sectors with large numbers of Internet-facing systems—especially **telecommunications, IT, and healthcare**—were flagged as particularly exposed. A public proof-of-concept is now available for **Apache HTTP Server**, where affected versions **2.4.17 through 2.4.67** can be forced into sustained memory exhaustion through crafted HTTP/2 cookie headers and a zero-window flow-control technique that prevents resources from being released. Apache fixed the issue in **2.4.68**, while other vendors have rolled out patches or mitigations on uneven timelines, including earlier fixes from nginx and Apache, a next-day patch from Envoy, a later mitigation from Microsoft, and no patch yet reported for Cloudflare at the time of coverage. Defenders are being urged to **upgrade immediately**, consider temporarily disabling HTTP/2 where feasible, and watch for abnormal memory growth and other signs of attempted DoS activity.
Jun 29, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026
Apache disclosed two vulnerabilities affecting multiple **ActiveMQ** components, including Client, Broker, and bundled distributions. **CVE-2026-33227** is a low-severity pathname restriction flaw that lets an authenticated user manipulate a supplied `key` value to traverse the classpath in two cases: when creating a **STOMP** consumer and when browsing messages through the web console. Apache warned the issue could expose classpath resource loading and potentially be chained with another attack. The flaw affects the 5.x branch before **5.19.3** and the 6.x branch from **6.0.0** before **6.2.2**, but Apache said those initial fixes were incomplete on Windows because of path separator handling, and recommended upgrading instead to **5.19.4** or **6.2.3**. Apache also published **CVE-2026-39304**, an important denial-of-service flaw in ActiveMQ's **NIO SSL transports** caused by incorrect handling of **TLS 1.3 `KeyUpdate`** messages. A client can repeatedly trigger updates and exhaust broker memory in the SSL engine, causing out-of-memory crashes and service disruption. Apache added that related handshake handling is also broken for earlier TLS versions such as **TLS 1.2**, though those cases lead to hung connections rather than memory exhaustion. The DoS issue affects the 5.x branch before **5.19.4** and the 6.x branch from **6.0.0** before **6.2.4**; users are advised to upgrade to **5.19.5** or **6.2.4**.
Jun 29, 2026