Qpid Proton C through 0.40.0 can overflow on bad TLS wildcards
Apache rates the stack read overflow low and says only non-RFC9525 wildcard certificates trigger it; 0.41.1 fixes it.
32
Vulnerability1 · 1 read
CVE-2026-115942
Stack read overflow in Apache Qpid Proton C via wildcard TLS cert
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Qpid Proton C can read past a stack buffer when verifying a misconfigured wildcard TLS certificate that does not follow RFC 9525. A peer that presents such a certificate during TLS verification can trigger the overflow. Certificates that already comply with RFC 9525 are not affected. Versions through 0.40.0 are affected.
What to do: Upgrade Apache Qpid Proton C to 0.41.1, which accepts only RFC 9525-compliant certificates.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Qpid Proton C | through 0.40.0 | 0.41.1 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Weakness
- CWE-125