CVE-2026-105031
The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
Severity
Important
Affected components
Apache Qpid Proton C
Affected versions
versions through 0.40.0
Fixed versions
0.41.1 and later
Description
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.
This issue does not affect the Windows SChannel TLS implementation.
Resolution
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Mitigation
This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.
Apache Qpid, Messaging built on AMQP; Copyright © 2015 The Apache Software Foundation; Licensed under the Apache License, Version 2.0; Apache Qpid, Qpid, Qpid Proton, Proton, Apache, the Apache logo, and the Apache Qpid project logo are trademarks of The Apache Software Foundation; All other marks mentioned may be trademarks or registered trademarks of their respective owners