Apache Qpid Proton C through 0.40.0 can crash on nested AMQP bodies
Original title: CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
Deeply nested message bodies decoded by pn_message_body() can overflow the stack; 0.41.1 fixes PROTON-2976.
Apache rated CVE-2026-105042 important in Apache Qpid Proton C through 0.40.0. A deeply nested AMQP message body decoded by pn_message_body() can overflow the stack and crash the process. Users are told to upgrade to 0.41.1. The issue is tracked as PROTON-2976.
- Affected releases are Apache Qpid Proton C through 0.40.0.
- The fixed release named in the advisory is 0.41.1.
- Severity is listed as important.
- Credit is given to zhangph and Gjoko Krstic.
Impact: Stack overflow crash while decoding a nested AMQP message body
| Product | Affected | Fixed in |
|---|---|---|
| Apache Qpid Proton C | through 0.40.0 | 0.41.1 |
- 1.Upgrade Apache Qpid Proton C to 0.41.1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105042 | Unbounded recursion crash in Apache Qpid Proton C through 0.40.0 | — | — |
From the original article
Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0. 40. 0 Description: A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.