DEBIAN-CVE-2026-115942: Debian/qpid-proton vulnerability

Published Oct 29, 2026

Updated

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

3 affected components

debian/qpid-proton*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Oct 29, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which versions require remediation?

Apache Qpid Proton C through version 0.40.0 is affected. Upgrade to version 0.41.1, which fixes the issue.

Are deployments using RFC9525-compliant wildcard certificates affected?

No. The issue does not affect wildcard certificates issued to the RFC9525 standard.

What can be done if an upgrade cannot happen immediately?

Ensure wildcard certificates comply with RFC9525. The fix restricts acceptance to certificates that comply with that standard.

DEBIAN-CVE-2026-115942: Debian/qpid-proton vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which versions require remediation?

Are deployments using RFC9525-compliant wildcard certificates affected?

What can be done if an upgrade cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which versions require remediation?

Are deployments using RFC9525-compliant wildcard certificates affected?

What can be done if an upgrade cannot happen immediately?