AZL-111751: CVE-2026-105042 affecting package qpid-proton 0.40.0-15

Q: What input is required to trigger the issue?

An attacker would need to cause pn_message_body() to decode a message body with deep nesting. Processing that message can overflow the stack and crash the affected application.

Q: Which versions should be remediated?

Apache Qpid Proton C through version 0.40.0 is affected. Upgrade to version 0.41.1, which fixes the issue.

Published Oct 29, 2026

Updated

A message body that is deeply nested and decoded by pnmessagebody() could overflow the stack and cause a crash.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

1 affected component

azure-linux/qpid-proton<=0.40.0-15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade qpid-proton to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-105042

Frequently Asked Questions

What input is required to trigger the issue?

An attacker would need to cause pn_message_body() to decode a message body with deep nesting. Processing that message can overflow the stack and crash the affected application.

Which versions should be remediated?

Apache Qpid Proton C through version 0.40.0 is affected. Upgrade to version 0.41.1, which fixes the issue.

AZL-111751: CVE-2026-105042 affecting package qpid-proton 0.40.0-15

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What input is required to trigger the issue?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the issue?

Which versions should be remediated?