DEBIAN-CVE-2026-105031: Debian/qpid-proton vulnerability
When using the OpenSSL TLS implementation, both the pnssldomainsettrustedcadb() & pntlsconfigsettrustedcerts() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSLCERTFILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Proton Cto a version that resolves this vulnerability.Fixed in 0.41.1 - Configuration
Set the SSL_CERT_FILE environment variable for the application to /dev/null as a workaround.
Application using Apache Qpid Proton C SSL_CERT_FILE = /dev/null
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Qpid Proton C deployments using the OpenSSL TLS implementation are affected through version 0.40.0. Deployments using the Win32 SChannel TLS implementation are not affected.
What configuration causes the unexpected certificate trust?
The issue occurs when pn_ssl_domain_set_trusted_ca_db() or pn_tls_config_set_trusted_certs() is used with OpenSSL. These APIs add the supplied trust anchors to the default system trust anchors instead of replacing them.
What can be done if an upgrade is not immediately possible?
Set the SSL_CERT_FILE environment variable for the application to /dev/null as a workaround. The recommended permanent remediation is upgrading to Apache Qpid Proton C version 0.41.1.