UBUNTU-CVE-2026-115942: Medium severity ubuntu/qpid-proton vulnerability

Published Nov 3, 2026

Updated

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Affected Software

7 affected components

ubuntu/qpid-proton*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Qpid Proton C to a version that resolves this vulnerability.
Fixed in 0.41.1

Event History

Nov 3, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Qpid Proton C deployments using wildcard TLS certificates that are misconfigured are affected through version 0.40.0. Wildcard certificates issued to the RFC9525 standard are not affected.

What must an attacker be able to do to trigger the vulnerability?

The issue is associated with a misconfigured wildcard TLS certificate causing a stack read overflow. The provided information does not specify any additional attacker access or interaction requirements.

What is the recommended remediation?

Upgrade Apache Qpid Proton C to version 0.41.1, which fixes the issue by accepting only certificates that comply with RFC9525.