CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Q: Which deployments are exposed to this issue?

Apache Qpid Proton C versions through 0.40.0 are affected when they verify a misconfigured wildcard TLS certificate. Wildcard certificates issued to the RFC9525 standard are not affected.

Q: What does an attacker need to exploit the issue?

Exploitation requires a non-compliant, misconfigured wildcard TLS certificate to be processed during TLS certificate verification. The provided information does not identify any other prerequisite.

Q: What should teams do to remediate the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. The fix restricts acceptance to wildcard certificates that comply with RFC9525.

Published Oct 28, 2026

Updated

A misconfigured wildcard TLS certificate causes a stack read overflow.

This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

1 affected component

Apache Qpid Proton C<=0.40.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

CVE Published

via MITRE·10:19 AM

Data Sourced

via MITRE·10:19 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Qpid Proton C versions through 0.40.0 are affected when they verify a misconfigured wildcard TLS certificate. Wildcard certificates issued to the RFC9525 standard are not affected.

What does an attacker need to exploit the issue?

Exploitation requires a non-compliant, misconfigured wildcard TLS certificate to be processed during TLS certificate verification. The provided information does not identify any other prerequisite.

What should teams do to remediate the issue?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue. The fix restricts acceptance to wildcard certificates that comply with RFC9525.

CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the issue?

What should teams do to remediate the issue?