A high-severity denial of service vulnerability in Apache Qpid Proton-J allows unauthenticated attackers to crash affected services via crafted type nesting.

This vulnerability is caused by uncontrolled recursion (CWE-674) within the software, allowing an unauthenticated attacker to exhaust stack resources by sending specifically crafted nested type structures.

The vulnerability carries a CVSS score of 7.5, indicating a high risk to service availability. Successful exploitation results in a denial of service, which can cause significant operational disruption for systems relying on Qpid Proton-J for messaging middleware. Because the attack requires no authentication, the barrier to entry for malicious actors is extremely low.

Immediate Action: Upgrade to Apache Qpid Proton-J version 0.35.0 or later to apply the necessary fix for uncontrolled recursion.

Proactive Monitoring: Monitor system logs and process status for unexpected service crashes or repeated StackOverflowError exceptions in the application logs.

Compensating Controls: Implement rate limiting or request size restrictions at the network perimeter to mitigate the impact of malicious payloads designed to trigger deep recursion.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the ease of exploitation, organizations using Apache Qpid Proton-J should prioritize upgrading to version 0.35.0. Maintaining service availability is critical, and applying this patch is the only effective way to prevent potential denial of service attacks against your messaging infrastructure.