Apache Qpid Proton-Dotnet Memory Exhaustion Denial of Service

CVE-2026-67551 represents a pre-authentication denial of service vulnerability in Apache Qpid Proton-Dotnet versions through 1.0.0, where attackers can exploit improper type size and count handling to trigger excessive memory allocation. This vulnerability is particularly significant because it requires no authentication, meaning any unauthenticated attacker with network access to a Qpid Proton-Dotnet service can trigger the condition. Organizations running message-oriented middleware based on Qpid Proton-Dotnet are directly impacted, including financial institutions, healthcare systems, and enterprises relying on AMQP protocol implementations for critical messaging infrastructure. The high CVSS score of 7.5 reflects the ease of exploitation and widespread availability impact.

While this CVE is not currently mapped to specific MITRE ATT&CK techniques, Casky's extended reasoning capabilities would identify this as a Resource Exhaustion attack pattern (conceptually aligned with Impact tactics). Practitioners using Casky would observe detection patterns focused on abnormal allocation requests, connection floods with malformed type specifications, and memory pressure indicators in their environment. Although no direct skill mappings currently exist for this specific CVE, organizations should monitor for pre-authentication connection attempts with unusual parameter sizes and implement immediate patching to version 1.1.0, which remedies the unsafe type handling logic that enables the denial of service condition.