CVE-2026-114230
Low risk· EPSS 19%Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass, though no user name will be set, so the effects depend on how the application handles this condition — meaning authentication has not completed yet. The issue affects Apache Qpid Proton C through 0.40.0.
Risk Assessment
An attacker may bypass the authentication process and gain unauthorized access to application functions, depending on how the application handles incomplete authentication.
Recommendation
Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. Verify how the application handles the incomplete authentication state.
Other vulnerabilities in Apache Qpid Proton C
See all- CVE-2026-115942Low risk· EPSS 3%
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard — the fix only accepts certificates that comply with this standard. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-105042Low risk· EPSS 14%
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-105031Low risk· EPSS 3%
A vulnerability in Apache Qpid Proton C (through 0.40.0) affects the OpenSSL TLS implementation. The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors, potentially causing unexpected peer certificates to be trusted.
Original NVD description (English source)
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS