Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)
pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.
48
Vulnerability1 · 1 read
CVE-2026-105031
Extra system trust anchors in Apache Qpid Proton C OpenSSL TLS
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
In Apache Qpid Proton C’s OpenSSL TLS path, pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add certificates to the default system trust anchors instead of replacing them. A remote peer can then be accepted with a certificate the application did not intend to trust. Only builds using OpenSSL are affected, through 0.40.0; the Win32 SChannel implementation is not.
What to do: Upgrade Apache Qpid Proton C to 0.41.1. Until then, set the application’s SSL_CERT_FILE environment variable to /dev/null.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Qpid Proton C | through 0.40.0 | 0.41.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Weakness
- CWE-295