CVE-2026-105031
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in Apache Qpid Proton C (through 0.40.0) affects the OpenSSL TLS implementation. The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors, potentially causing unexpected peer certificates to be trusted.
Risk Assessment
The organization may accept TLS connections from untrusted parties, increasing the risk of man-in-the-middle attacks and unauthorized data access.
Recommendation
Upgrade Apache Qpid Proton C to version 0.41.1 or later. As a workaround, set the SSL_CERT_FILE environment variable to /dev/null for the application.
Other vulnerabilities in Apache Qpid Proton C
See all- CVE-2026-115942Low risk· EPSS 3%
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard — the fix only accepts certificates that comply with this standard. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-114230Low risk· EPSS 19%
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass, though no user name will be set, so the effects depend on how the application handles this condition — meaning authentication has not completed yet. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-105042Low risk· EPSS 14%
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. The issue affects Apache Qpid Proton C through 0.40.0.
Original NVD description (English source)
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS