Apache Qpid Proton C: Stack buffer overflow read in TLS certificate validation (CVE-2026-115942)
Apache Qpid Proton C versions through 0.40.0 contain a stack buffer overflow read vulnerability triggered by misconfigured wildcard TLS certificates.
CVE search metadata
CVE search record: CVE-2026-115942. KEV: no. Product: Qpid Proton C (<= 0.40.0). Brief: Apache Qpid Proton C: Stack buffer overflow read in TLS certificate validation (CVE-2026-115942). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-qpid-proton-c-buffer-overflow/
CVE search record: CVE-2026-105042. KEV: no. Product: Qpid Proton C (<= 0.40.0). Brief: Apache Qpid Proton C: Stack buffer overflow read in TLS certificate validation (CVE-2026-115942). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-qpid-proton-c-buffer-overflow/
Triage facts
Revision 1- Applicability
- Qpid Proton C (<= 0.40.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 28, 22:24 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- D3Roughly even chance
What's new
- 1. added coverage for Qpid Proton C (<= 0.40.0) Oct 28, 22:24 via oss-security
Apache Qpid Proton C versions through 0.40.0 are affected by a stack buffer overflow read caused by the verification of non-compliant wildcard TLS certificates. The issue does not affect certificates issued to the RFC9525 standard. Version 0.41.1 has been released to fix this issue by only accepting certificates that comply with the RFC9525 standard.
Immediate actions
Patch Apache Qpid Proton C to version 0.41.1
Threat Hunt
Monitor application logs for recurring segmentation faults or abrupt termination of services linked against libqpid-proton
Data: Application crash logs, System auditd or service manager logs (e.g., systemd)
Mitigations
Upgrade to Qpid Proton C 0.41.1
CVE-2026-105042