DEBIAN-CVE-2026-105042: Debian/qpid-proton vulnerability

Published Oct 29, 2026

Updated

A message body that is deeply nested and decoded by pnmessagebody() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

3 affected components

debian/qpid-proton*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

What attacker-controlled input is required to trigger the crash?

An attacker would need to provide a message body with deep nesting that is subsequently decoded by pn_message_body().

What is the impact if the issue is exploited?

Deeply nested message decoding can overflow the stack and crash the affected process, resulting in a denial of service.

What versions should be upgraded?

Apache Qpid Proton C through version 0.40.0 is affected. Upgrade to version 0.41.1, which fixes the issue.

DEBIAN-CVE-2026-105042: Debian/qpid-proton vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker-controlled input is required to trigger the crash?

What is the impact if the issue is exploited?

What versions should be upgraded?

Company

Resources

Contact

Frequently Asked Questions

What attacker-controlled input is required to trigger the crash?

What is the impact if the issue is exploited?

What versions should be upgraded?