Apache Qpid Proton C
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_qpid_proton_c:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Qpid Proton C (3be25517-b1e5-5bb5-8fa0-b259fe32f8ec) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-105042 |
vulnerable | 2026-11-03 10:16:33.162660 |
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Published: 2026-10-29T10:17:20.853Z
Updated: 2026-11-05T21:29:09.604Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-105031 |
vulnerable | 2026-11-03 10:16:33.023147 |
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.
This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.
This issue does not affect the Win32 SChannel TLS implementation.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Published: 2026-10-29T10:16:41.384Z
Updated: 2026-11-05T21:28:21.353Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114230 |
vulnerable | 2026-11-03 10:15:53.575552 |
Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Published: 2026-10-29T10:19:15.580Z
Updated: 2026-11-05T21:29:56.557Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115942 |
vulnerable | 2026-11-03 10:15:37.775929 |
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Published: 2026-10-29T10:19:58.757Z
Updated: 2026-11-05T21:31:02.254Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.