CVE-2026-115942
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
CVE-2026-115942- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-112720
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
EUVD-2026-112720- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-h5r3-v75j-gx8v
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not...
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
GHSA-h5r3-v75j-gx8v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-06
NVD
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
CVE-2026-115942- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-115942
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
DEBIAN-CVE-2026-115942- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-115942
A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
UBUNTU-CVE-2026-115942- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-07
OSVAZL-111745 No score
CVE-2026-115942 affecting package qpid-proton 0.40.0-15
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
- Record
AZL-111745- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qpid-protonAzure Linux:3 |
through 0.40.0-15 | None known |
qpid-protonDebian:12 |
All versions, plus listed versions 0.37.0-100.37.0-20.37.0-30.37.0-40.37.0-5 Show 4 moreShow less0.37.0-60.37.0-70.37.0-80.37.0-9 |
None known |
qpid-protonDebian:13 |
All versions, plus listed versions 0.37.0-100.37.0-60.37.0-70.37.0-80.37.0-9 |
None known |
qpid-protonDebian:14 |
All versions, plus listed versions 0.37.0-100.37.0-60.37.0-70.37.0-80.37.0-9 |
None known |
qpid-protonUbuntu:16.04:LTS |
All versions, plus listed versions 0.7-20.10-2 |
None known |
qpid-protonUbuntu:18.04:LTS |
All versions, plus listed versions 0.14.0-5.10.14.0-5.1ubuntu1 |
None known |
qpid-protonUbuntu:20.04:LTS |
All versions, plus listed versions 0.22.0-3.20.22.0-3.2build10.22.0-3.30.22.0-3.3build1 |
None known |
qpid-protonUbuntu:22.04:LTS |
All versions, plus listed versions 0.22.0-5.10.22.0-5.1build10.22.0-5.1ubuntu10.22.0-5.1ubuntu2 |
None known |
qpid-protonUbuntu:24.04:LTS |
All versions, plus listed versions 0.37.0-2build10.37.0-2build20.37.0-2build40.37.0-2build5 |
None known |
qpid-protonUbuntu:26.10 |
All versions, plus listed versions 0.37.0-7build10.37.0-80.37.0-90.37.0-9build1 |
None known |
qpid-protonUbuntu:26.04:LTS |
All versions, plus listed versions 0.37.0-60.37.0-6build10.37.0-70.37.0-7build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List, OSV | |
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115942 is a high vulnerability (CVSS 7.5) in Apache Software Foundation Qpid Proton C, published October 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.
References
lists.apache.org/thread.html/5z8x4c1939rxs5hod7q7gvgdmjd7p7pt
openwall.com/lists/oss-security/2026/10/28/25
nvd.nist.gov/vuln/detail/CVE-2026-115942
github.com/advisories/GHSA-h5r3-v75j-gx8v
security-tracker.debian.org/tracker/CVE-2026-115942
ubuntu.com/security/CVE-2026-115942
cve.org/CVERecord?id=CVE-2026-115942
issues.apache.org/jira/browse/PROTON-2974