AZL-111748: CVE-2026-105031 affecting package qpid-proton 0.40.0-15

Q: Which deployments are affected?

Deployments using Apache Qpid Proton C through 0.40.0 with the OpenSSL TLS implementation are affected. The Win32 SChannel TLS implementation is not affected.

Q: What is required for exploitation?

An affected application must use pn_ssl_domain_set_trusted_ca_db() or pn_tls_config_set_trusted_certs() with OpenSSL TLS and then connect to a peer whose certificate chains to an unexpected system trust anchor. The configured trust store is added to, rather than replacing, the default system trust anchors.

Q: What can be done if an upgrade is not immediately possible?

Set the SSL_CERT_FILE environment variable for the affected application to /dev/null as a workaround. This prevents use of the default system trust anchors.

Q: What version fixes the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the trust-anchor replacement behavior.

Published Oct 29, 2026

Updated

When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb() & pntlsconfigsettrustedcerts() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.

This can be worked around by setting the SSLCERTFILE environment variable for the application to /dev/null.

This issue does not affect the Win32 SChannel TLS implementation.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

1 affected component

azure-linux/qpid-proton<=0.40.0-15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade qpid-proton to a version that resolves this vulnerability.
Fixed in 0.41.1
Configuration
Set the SSL_CERT_FILE environment variable to /dev/null as a workaround.
Application using the OpenSSL TLS implementation SSL_CERT_FILE = /dev/null

Event History

Oct 29, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-105031

Frequently Asked Questions

Which deployments are affected?

Deployments using Apache Qpid Proton C through 0.40.0 with the OpenSSL TLS implementation are affected. The Win32 SChannel TLS implementation is not affected.

What is required for exploitation?

An affected application must use pn_ssl_domain_set_trusted_ca_db() or pn_tls_config_set_trusted_certs() with OpenSSL TLS and then connect to a peer whose certificate chains to an unexpected system trust anchor. The configured trust store is added to, rather than replacing, the default system trust anchors.

What can be done if an upgrade is not immediately possible?

Set the SSL_CERT_FILE environment variable for the affected application to /dev/null as a workaround. This prevents use of the default system trust anchors.

What version fixes the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the trust-anchor replacement behavior.

AZL-111748: CVE-2026-105031 affecting package qpid-proton 0.40.0-15

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are affected?

What is required for exploitation?

What can be done if an upgrade is not immediately possible?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What is required for exploitation?

What can be done if an upgrade is not immediately possible?

What version fixes the issue?