Search
Find a vulnerability
Search criteria
8 vulnerabilities found for Apache Qpid Proton C by Apache Software Foundation
CVE-2026-115942 (GCVE-0-2026-115942)
Vulnerability from nvd – Published: 2026-10-29 10:19 – Updated: 2026-10-29 11:09
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
Summary
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/5z8x4c1939rx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:09:37.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zhangph@yandex.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA misconfigured wildcard TLS certificate causes a stack read overflow.\u003c/p\u003e\u003cp\u003eThis issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A misconfigured wildcard TLS certificate causes a stack read overflow.\n\n\n\nThis issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:19:58.757Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/5z8x4c1939rxs5hod7q7gvgdmjd7p7pt"
}
],
"source": {
"defect": [
"PROTON-2974"
],
"discovery": "EXTERNAL"
},
"title": "Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-115942",
"datePublished": "2026-10-29T10:19:58.757Z",
"dateReserved": "2026-10-23T21:59:47.705Z",
"dateUpdated": "2026-10-29T11:09:37.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114230 (GCVE-0-2026-114230)
Vulnerability from nvd – Published: 2026-10-29 10:19 – Updated: 2026-10-29 11:09
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Summary
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-305 - Authentication bypass by primary weakness
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/ob7vo6swpj4w… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:09:06.927Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication bypass by primary weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:19:15.580Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k"
}
],
"source": {
"defect": [
"PROTON-2945"
],
"discovery": "INTERNAL"
},
"title": "Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114230",
"datePublished": "2026-10-29T10:19:15.580Z",
"dateReserved": "2026-10-21T05:27:42.658Z",
"dateUpdated": "2026-10-29T11:09:06.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105042 (GCVE-0-2026-105042)
Vulnerability from nvd – Published: 2026-10-29 10:17 – Updated: 2026-10-29 11:08
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
Summary
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/7v54gx7o1ptx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:08:30.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/23"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zhangph@yandex.com"
},
{
"lang": "en",
"type": "finder",
"value": "Gjoko Krstic \u003cgjoko@zeroscience.mk\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:17:20.853Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28"
}
],
"source": {
"defect": [
"PROTON-2976"
],
"discovery": "EXTERNAL"
},
"title": "Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105042",
"datePublished": "2026-10-29T10:17:20.853Z",
"dateReserved": "2026-10-02T21:31:42.230Z",
"dateUpdated": "2026-10-29T11:08:30.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105031 (GCVE-0-2026-105031)
Vulnerability from nvd – Published: 2026-10-29 10:16 – Updated: 2026-10-29 11:08
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
Summary
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.
This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.
This issue does not affect the Win32 SChannel TLS implementation.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-295 - Improper certificate validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/lc10nrjt2dwc… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:08:28.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026amp;\u0026nbsp;pn_tls_config_set_trusted_certs() APIs \u003cb\u003eadded\u003c/b\u003e to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\u003c/p\u003e\u003cp\u003eThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\u003c/p\u003e\u003cp\u003eThis issue does not affect the Win32 SChannel TLS implementation.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:16:41.384Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4"
}
],
"source": {
"defect": [
"PROTON-2976"
],
"discovery": "INTERNAL"
},
"title": "Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105031",
"datePublished": "2026-10-29T10:16:41.384Z",
"dateReserved": "2026-10-02T21:28:25.620Z",
"dateUpdated": "2026-10-29T11:08:28.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115942 (GCVE-0-2026-115942)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:19 – Updated: 2026-10-29 11:09
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
Summary
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-125 - Out-of-bounds read
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/5z8x4c1939rx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:09:37.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zhangph@yandex.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA misconfigured wildcard TLS certificate causes a stack read overflow.\u003c/p\u003e\u003cp\u003eThis issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A misconfigured wildcard TLS certificate causes a stack read overflow.\n\n\n\nThis issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:19:58.757Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/5z8x4c1939rxs5hod7q7gvgdmjd7p7pt"
}
],
"source": {
"defect": [
"PROTON-2974"
],
"discovery": "EXTERNAL"
},
"title": "Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-115942",
"datePublished": "2026-10-29T10:19:58.757Z",
"dateReserved": "2026-10-23T21:59:47.705Z",
"dateUpdated": "2026-10-29T11:09:37.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114230 (GCVE-0-2026-114230)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:19 – Updated: 2026-10-29 11:09
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Summary
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-305 - Authentication bypass by primary weakness
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/ob7vo6swpj4w… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:09:06.927Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication bypass by primary weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:19:15.580Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k"
}
],
"source": {
"defect": [
"PROTON-2945"
],
"discovery": "INTERNAL"
},
"title": "Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-114230",
"datePublished": "2026-10-29T10:19:15.580Z",
"dateReserved": "2026-10-21T05:27:42.658Z",
"dateUpdated": "2026-10-29T11:09:06.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105042 (GCVE-0-2026-105042)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:17 – Updated: 2026-10-29 11:08
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
Summary
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/7v54gx7o1ptx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:08:30.677Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/23"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zhangph@yandex.com"
},
{
"lang": "en",
"type": "finder",
"value": "Gjoko Krstic \u003cgjoko@zeroscience.mk\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674 Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:17:20.853Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28"
}
],
"source": {
"defect": [
"PROTON-2976"
],
"discovery": "EXTERNAL"
},
"title": "Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105042",
"datePublished": "2026-10-29T10:17:20.853Z",
"dateReserved": "2026-10-02T21:31:42.230Z",
"dateUpdated": "2026-10-29T11:08:30.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105031 (GCVE-0-2026-105031)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:16 – Updated: 2026-10-29 11:08
VLAI
EPSS
VEX
Title
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
Summary
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.
This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.
This issue does not affect the Win32 SChannel TLS implementation.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Severity
No CVSS data available.
CWE
- CWE-295 - Improper certificate validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/lc10nrjt2dwc… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C |
Affected:
0 , ≤ 0.40.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-29T11:08:28.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/28/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:software-id/apache.org/qpid-proton",
"product": "Apache Qpid Proton C",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "0.40.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026amp;\u0026nbsp;pn_tls_config_set_trusted_certs() APIs \u003cb\u003eadded\u003c/b\u003e to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\u003c/p\u003e\u003cp\u003eThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\u003c/p\u003e\u003cp\u003eThis issue does not affect the Win32 SChannel TLS implementation.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Qpid Proton C: through 0.40.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.41.1, which fixes the issue.\u003c/p\u003e"
}
],
"value": "When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:16:41.384Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4"
}
],
"source": {
"defect": [
"PROTON-2976"
],
"discovery": "INTERNAL"
},
"title": "Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105031",
"datePublished": "2026-10-29T10:16:41.384Z",
"dateReserved": "2026-10-02T21:28:25.620Z",
"dateUpdated": "2026-10-29T11:08:28.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}