UBUNTU-CVE-2026-105042: Medium severity ubuntu/qpid-proton vulnerability

Published Nov 3, 2026

Updated

A message body that is deeply nested and decoded by pnmessagebody() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

7 affected components

ubuntu/qpid-proton*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input is required to trigger the crash?

An attacker would need a message body that is deeply nested and that is decoded by pn_message_body(). Processing that input can overflow the stack and crash the affected process.

Which versions should be remediated?

Apache Qpid Proton C versions through 0.40.0 are affected. Upgrade to version 0.41.1, which fixes the issue.