CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

Q: Which deployments are exposed to this issue?

Apache Qpid Proton C versions through 0.40.0 are affected when they decode deeply nested AMQP message bodies using pn_message_body().

Q: What must an attacker do to trigger the crash?

An attacker needs to cause the affected application to decode an AMQP message body with sufficiently deep nesting through pn_message_body(). The resulting unbounded recursion can overflow the stack and crash the process.

Q: What should teams do to remediate the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue.

Published Oct 28, 2026

Updated

A message body that is deeply nested and decoded by pnmessagebody() could overflow the stack and cause a crash.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

1 affected component

Apache Qpid Proton C<=0.40.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

CVE Published

via MITRE·10:17 AM

Data Sourced

via MITRE·10:17 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Qpid Proton C versions through 0.40.0 are affected when they decode deeply nested AMQP message bodies using pn_message_body().

What must an attacker do to trigger the crash?

An attacker needs to cause the affected application to decode an AMQP message body with sufficiently deep nesting through pn_message_body(). The resulting unbounded recursion can overflow the stack and crash the process.

What should teams do to remediate the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue.

CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the crash?

What should teams do to remediate the issue?