CVE-2026-115942

A flaw was found in Apache Qpid Proton. When processing a misconfigured wildcard TLS Transport Layer Security certificate that does not comply with standard specifications, the application triggers an out-of-bounds read on the stack. A remote attacker could exploit this vulnerability by presentin...

CVE-2026-114230

A flaw was found in qpid-proton. When authenticating a peer connection using Simple Authentication and Security Layer SASL, the software improperly processes Advanced Message Queuing Protocol AMQP frames that falsely claim to be SASL frames. A remote attacker can exploit this flaw by sending...

CVE-2026-105042

A flaw was found in Apache Qpid Proton C. An attacker can supply a specially crafted message containing deeply nested data structures that, when decoded by the pnmessagebody function, triggers a stack overflow. This failure causes the application to crash, resulting in a Denial of Service DoS...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service via unbounded type nesting

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability related to unbounded type nesting. This could lead to a StackOverflowError, causing the affected system to become unresponsive and resulting in a denial of service...

CVE-2026-92573

A flaw was found in Apache Qpid Broker-J. An authenticated attacker can cause a Denial of Service DoS by sending specially crafted compressed data to the message broker. Because the shared decompression mechanism does not enforce limits on decompressed output size during Advanced Message Queuing...

CVE-2026-105031

A flaw was found in qpid-proton. When configuring custom trusted certificates with the OpenSSL Transport Layer Security TLS implementation, the library appends the certificates to default system trust anchors instead of replacing them. This improper certificate validation can allow a remote...

SUSE CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

SUSE CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

SUSE CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

SUSE CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

AZL-111745 CVE-2026-115942 affecting package qpid-proton 0.40.0-15

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

CVE-2026-115942

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommende...

AZL-111742 CVE-2026-114230 affecting package qpid-proton 0.40.0-15

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

CVE-2026-114230

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means th...

AZL-111751 CVE-2026-105042 affecting package qpid-proton 0.40.0-15

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

CVE-2026-105042

A message body that is deeply nested and decoded by pnmessagebody could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue...

AZL-111748 CVE-2026-105031 affecting package qpid-proton 0.40.0-15

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...

CVE-2026-105031

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb & pntlsconfigsettrustedcerts APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE...