Hi,
The following vulnerabilities were published for qpid-proton.
CVE-2026-105031[0]:
| When using the OpenSSL TLS implementation, both the
| pn_ssl_domain_set_trusted_ca_db()
| & pn_tls_config_set_trusted_certs() APIs added to rather than
| replaced the default system trust anchors. Leading to potentially
| trusting unexpected peer certificates. This can be worked around
| by setting the SSL_CERT_FILE environment variable for the
| application to /dev/null. This issue does not affect the Win32
| SChannel TLS implementation. This issue affects Apache Qpid
| Proton C: through 0.40.0. Users are recommended to upgrade to
| version 0.41.1, which fixes the issue.
CVE-2026-105042[1]:
| A message body that is deeply nested and decoded by
| pn_message_body() could overflow the stack and cause a crash.
| This issue affects Apache Qpid Proton C: through 0.40.0. Users
| are recommended to upgrade to version 0.41.1, which fixes the issue.
CVE-2026-114230[2]:
| When dispatching SASL frames to authenticate the peer, Proton will
| also dispatch AMQP frames if they claim to be SASL frames. This
| allows authentication bypass. However there will be no user name set
| so the effects depend on how the application deals with this
| condition - which otherwise means that authentication has not
| completed yet. This issue affects Apache Qpid Proton C: through
| 0.40.0. Users are recommended to upgrade to version 0.41.1, which
| fixes the issue.
CVE-2026-115942[3]:
| A misconfigured wildcard TLS certificate causes a stack read
| overflow. This issue does not affect any wildcard certificate
| issued to the RFC9525 standard - the fix only accepts certificates
| that comply to this standard. This issue affects Apache Qpid
| Proton C: through 0.40.0. Users are recommended to upgrade to
| version 0.41.1, which fixes the issue.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-105031
https://www.cve.org/CVERecord?id=CVE-2026-105031
[1] https://security-tracker.debian.org/tracker/CVE-2026-105042
https://www.cve.org/CVERecord?id=CVE-2026-105042
[2] https://security-tracker.debian.org/tracker/CVE-2026-114230
https://www.cve.org/CVERecord?id=CVE-2026-114230
[3] https://security-tracker.debian.org/tracker/CVE-2026-115942
https://www.cve.org/CVERecord?id=CVE-2026-115942
Regards,
Salvatore