Qpid Proton C through 0.40.0 can overflow on bad TLS wildcards
Original title: CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
Apache rates the stack read overflow low and says only non-RFC9525 wildcard certificates trigger it; 0.41.1 fixes it.
Andrew Stitcher reported CVE-2026-115942 in Apache Qpid Proton C through 0.40.0. A misconfigured wildcard TLS certificate can cause a stack buffer overflow read while the certificate is verified. Certificates that follow RFC9525 are not affected; the fix accepts only compliant certificates. Users are told to upgrade to 0.41.1. Apache lists severity as low.
Unconfirmed: The mailing-list snippet does not say whether the flaw has been exploited.
- Affected range is Apache Qpid Proton C through 0.40.0.
- Fixed release named in the post is 0.41.1.
- The overflow is a stack read, not described as code execution.
- Posted to oss-security on October 28.
Impact: Stack buffer overflow read while verifying a TLS certificate
| Product | Affected | Fixed in |
|---|---|---|
| Apache Qpid Proton C | through 0.40.0 | 0.41.1 |
- 1.Upgrade Apache Qpid Proton C to 0.41.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115942 | Stack read overflow in Apache Qpid Proton C via wildcard TLS cert | — | — |
From the original article
Posted by Andrew Stitcher on Oct 28 Severity: low Affected versions: - Apache Qpid Proton C through 0. 40. 0 Description: A misconfigured wildcard TLS certificate causes a stack read overflow.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.