CVE-2026-115942
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard — the fix only accepts certificates that comply with this standard. The issue affects Apache Qpid Proton C through 0.40.0.
Risk Assessment
Processing a malformed certificate may lead to a stack overflow and application crash, which could be exploited for a denial of service attack.
Recommendation
Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. Ensure wildcard certificates in use comply with RFC9525.
Other vulnerabilities in Apache Qpid Proton C
See all- CVE-2026-114230Low risk· EPSS 19%
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass, though no user name will be set, so the effects depend on how the application handles this condition — meaning authentication has not completed yet. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-105042Low risk· EPSS 14%
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. The issue affects Apache Qpid Proton C through 0.40.0.
- CVE-2026-105031Low risk· EPSS 3%
A vulnerability in Apache Qpid Proton C (through 0.40.0) affects the OpenSSL TLS implementation. The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors, potentially causing unexpected peer certificates to be trusted.
Original NVD description (English source)
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS