SUSE CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

SUSE CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

SUSE CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

SUSE CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

AZL-111751 CVE-2026-105042 affecting package qpid-proton 0.40.0-15

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

CVE-2026-115942 Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

EUVD-2026-112720

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-115942

The Apache Qpid Proton C library, versions through 0.40.0 , is vulnerable to a stack read overflow caused by the processing of a misconfigured wildcard TLS certificate . This issue is specifically triggered by certificates that do not comply with the RFC9525 standard. The vulnerability is correct...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

EUVD-2026-112719

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-114230 Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-114230

The Apache Qpid Proton C library (versions through 0.40.0 ) is vulnerable to an authentication bypass due to a flaw in how it dispatches SASL frames. Specifically, the system will also dispatch AMQP frames if they claim to be SASL frames. While this bypass occurs, no username is set, meaning the ...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-105042 Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

Apache Qpid Proton C versions through 0.40.0 are vulnerable to a denial-of-service (DoS) condition due to unbounded recursion in the AMQP decoder. The pn_message_body() function decodes message bodies and recurses once per nested compound type without a depth limit. A remote peer can exploit this...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...