Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Apache discloses four Qpid Proton C flaws through 0.40.0

1 source · 4 articlesFirst reported Updated ()1
What's new

October 28: Two further Proton C advisories add an important SASL authentication bypass with no named fix and a low-severity wildcard TLS stack read fixed in 0.41.1.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Four Apache Qpid Proton C issues through 0.40.0 were posted October 28; two are fixed in 0.41.1 and two name no fix.

Apache disclosed four issues in Apache Qpid Proton C through 0.40.0 on oss-security on October 28. CVE-2026-105031, rated important, makes OpenSSL APIs add trusted CAs to system anchors instead of replacing them; the workaround is setting SSL_CERT_FILE, and no fix is named. CVE-2026-105042, also important, is unbounded recursion in pn_message_body() that can crash on deeply nested AMQP bodies and is fixed in 0.41.1. CVE-2026-114230, rated important, can treat regular AMQP frames as SASL frames with no username set; impact depends on the application, and no fixed version is named. CVE-2026-115942, rated low, is a stack buffer overflow read from non-RFC9525 wildcard TLS certificates and is fixed in 0.41.1.

Key facts
  • Affected range for all four issues is Proton C through 0.40.0.
  • CVE-2026-105042 and CVE-2026-115942 are fixed in 0.41.1.
  • CVE-2026-105031 workaround is the SSL_CERT_FILE environment variable.
  • CVE-2026-114230 sets no username; effect depends on the application.
  • CVE-2026-105042 is tracked as PROTON-2976; credit to zhangph and Gjoko Krstic.
  • Only non-RFC9525 wildcard certificates trigger the low-severity stack read.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 28, 2026Apache posts important OpenSSL trust-anchor flaw CVE-2026-105031. · oss-security
  2. Oct 28, 2026Apache posts AMQP body crash CVE-2026-105042, fixed in 0.41.1. · oss-security
  3. Oct 28, 2026Andrew Stitcher discloses SASL authentication bypass CVE-2026-114230. · oss-security
  4. Oct 28, 2026Stitcher reports low-severity wildcard TLS stack read fixed in 0.41.1. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityNames the two trust APIs and the SSL_CERT_FILE workaround.
  • oss-securityCredits zhangph and Gjoko Krstic; tracks PROTON-2976.
  • oss-securitySays AMQP frames can be dispatched as SASL with no username.
  • oss-securityLimits the stack read to non-RFC9525 wildcard certificates.
CVEs
CVE-2026-114230CVE-2026-105031CVE-2026-105042CVE-2026-115942
Vendors
Apache
Products
Qpid Proton C

Coverage

oldest first · one row per article · UTC
  1. · 2d ago oss-securityFirst report

    Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)

    pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.

  2. · 2d ago oss-security

    Apache Qpid Proton C through 0.40.0 can crash on nested AMQP bodies

    Deeply nested message bodies decoded by pn_message_body() can overflow the stack; 0.41.1 fixes PROTON-2976.

  3. · 2d ago oss-security

    Qpid Proton C through 0.40.0 can treat AMQP frames as SASL

    Apache calls the flaw important: peers can send regular AMQP frames that Proton dispatches as SASL, with no username set.

  4. · 2d ago oss-security

    Qpid Proton C through 0.40.0 can overflow on bad TLS wildcards

    Apache rates the stack read overflow low and says only non-RFC9525 wildcard certificates trigger it; 0.41.1 fixes it.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-105031
+3 related CVEs
CVE-2026-105042CVE-2026-114230CVE-2026-115942
Extra system trust anchors in Apache Qpid Proton C OpenSSL TLS
——