CVE-2026-115942

A flaw was found in Apache Qpid Proton. When processing a misconfigured wildcard TLS Transport Layer Security certificate that does not comply with standard specifications, the application triggers an out-of-bounds read on the stack. A remote attacker could exploit this vulnerability by presentin...

CVE-2026-105042

A flaw was found in Apache Qpid Proton C. An attacker can supply a specially crafted message containing deeply nested data structures that, when decoded by the pnmessagebody function, triggers a stack overflow. This failure causes the application to crash, resulting in a Denial of Service DoS...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service...

CVE-2026-92573

A flaw was found in Apache Qpid Broker-J. An authenticated attacker can cause a Denial of Service DoS by sending specially crafted compressed data to the message broker. Because the shared decompression mechanism does not enforce limits on decompressed output size during Advanced Message Queuing...

SUSE CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

SUSE CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

SUSE CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

SUSE CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

AZL-111751 CVE-2026-105042 affecting package qpid-proton 0.40.0-15

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

UBUNTU-CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

UBUNTU-CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...