Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)

Original title: CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.

oss-security ()1
Read at seclists.org
Part of a story covered by 4 sourcesApache discloses four Qpid Proton C flaws through 0.40.0Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.

Apache rated CVE-2026-105031 important in Apache Qpid Proton C through 0.40.0. With the OpenSSL TLS implementation, two APIs that set trusted certificates add them to the default system trust anchors rather than replacing those anchors, so unexpected peer certificates may be trusted. A workaround is to set the SSL_CERT_FILE environment variable. The posted text does not name a fixed release.

Unconfirmed: The visible post does not state a fixed version.

Key facts
  • Affected product is Apache Qpid Proton C through 0.40.0.
  • The APIs are pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs().
  • Workaround stated: set the SSL_CERT_FILE environment variable.
  • Severity is listed as important.
Security assessment · AI, from the article

Impact: May trust unexpected peer certificates during TLS

ProductAffected
Apache Qpid Proton Cthrough 0.40.0
What to do
  1. 1.Set SSL_CERT_FILE so only the intended trust anchors are used.
Analyze CVE-2026-105031 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-105031
Tags
apacheqpid-protonopenssltlscertificate-validation
Vendors
Apache
Products
Qpid Proton C

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-105031
Extra system trust anchors in Apache Qpid Proton C OpenSSL TLS
——

From the original article

Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0. 40. 0 Description: When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.