UBUNTU-CVE-2026-114230: Medium severity ubuntu/qpid-proton vulnerability
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Qpid Proton Cto a version that resolves this vulnerability.Fixed in 0.41.1
Event History
Frequently Asked Questions
What conditions are required for an attacker to bypass authentication?
An attacker needs to be able to send AMQP frames that claim to be SASL frames during peer authentication. The resulting session has no user name set, so practical impact depends on whether the application accepts or acts on connections before authentication is considered complete.
Which versions are affected and what version fixes the issue?
Apache Qpid Proton C through version 0.40.0 is affected. Version 0.41.1 fixes the issue.
How can I assess whether my application is exposed beyond using an affected library version?
Review how the application handles connections with no user name and whether it permits actions before authentication has completed. Applications that require completed authentication and reject unauthenticated or userless connections may limit the impact.