CVE-2026-115942

Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Severity

Low

Affected components

Apache Qpid Proton C

Affected versions

versions through 0.40.0

Fixed versions

0.41.1 and later

Description

A misconfigured wildcard TLS certificate causes a stack read overflow.

This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.

Resolution

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Credit

zhangph

---

• Apache
• License
• Sponsorship
• Thanks!
• Security
• 

Apache Qpid, Messaging built on AMQP; Copyright © 2015 The Apache Software Foundation; Licensed under the Apache License, Version 2.0; Apache Qpid, Qpid, Qpid Proton, Proton, Apache, the Apache logo, and the Apache Qpid project logo are trademarks of The Apache Software Foundation; All other marks mentioned may be trademarks or registered trademarks of their respective owners