CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

CVE-2026-115942

The Apache Qpid Proton C library, versions through 0.40.0 , is vulnerable to a stack read overflow caused by the processing of a misconfigured wildcard TLS certificate . This issue is specifically triggered by certificates that do not comply with the RFC9525 standard. The vulnerability is correct...

EUVD-2026-112720

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-114230

The Apache Qpid Proton C library (versions through 0.40.0 ) is vulnerable to an authentication bypass due to a flaw in how it dispatches SASL frames. Specifically, the system will also dispatch AMQP frames if they claim to be SASL frames. While this bypass occurs, no username is set, meaning the ...

EUVD-2026-112719

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

EUVD-2026-112726

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

Apache Qpid Proton C versions through 0.40.0 are vulnerable to a denial-of-service (DoS) condition due to unbounded recursion in the AMQP decoder. The pn_message_body() function decodes message bodies and recurses once per nested compound type without a depth limit. A remote peer can exploit this...

CVE-2026-105031

The Apache Qpid Proton C library (versions through 0.40.0 ) is vulnerable when using the OpenSSL TLS implementation. The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs incorrectly append to, rather than replace, default system trust anchors. This behavior can lead to...

EUVD-2026-112725

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Summary Qpid Proton is a high-performance, lightweight messaging library. It can be used in the widest range of messaging applications, including brokers, client libraries, routers, bridges, proxies, and more. Proton makes it trivial to integrate with the AMQP 1.0 ecosystem from any platform,...

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Apache Qpid Proton C API version 0.40.0 contains an unbounded recursion flaw in its AMQP decoder that allows remote unauthenticated peers to exhaust the stack and cause a denial of service. !/usr/bin/env bash Apache Qpid Proton C API 0.40.0 Remote Stack Overflow Vendor: The Apache Software...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Summary A high-performance, lightweight AMQP 1.0 message router, written in C and built on Qpid Proton. It provides flexible and scalable interconnect between any AMQP endpoints, whether they be clients, brokers or other AMQP-enabled services. Description Apache Qpid Dispatch suffers from a...

Apache Qpid Dispatch Router 1.19.0 Remote Stack Overflow

Apache Qpid Dispatch Router version 1.19.0 contains an unbounded recursion denial-of-service vulnerability in its AMQP field parser. A mutually authenticated remote peer can supply deeply nested message annotations to exhaust the stack and crash the router. / Apache Qpid Dispatch Router 1.19.0...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of type size/count, where excessive memory allocation can occur and a pre-authentication attacker can trigger it to cause a denial of service...

Security Bulletin: IBM QRadar SIEM interation for Microsoft Azure Event Hub contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM integration with Microsoft Azure Event Hub Vulnerability Details CVEID:CVE-2026-66257 DESCRIPTION: A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion...

Uncontrolled Resource Consumption

Apache Qpid ProtonJ2 is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the lack of a limit on the number of transfer frames per incoming delivery, which allows an authenticated attacker to cause excessive resource consumption and potentially trigger a denial-of-servi...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to resource exhaustion. The vulnerability is due to unbounded symbol value caching, where symbol values are cached without size limits and a pre-authentication attacker can send crafted input to exhaust resources, leading to denial of service...