{"id":"CVE-2026-105031","aliases":["AZL-111748","DEBIAN-CVE-2026-105031","EUVD-2026-112725","GHSA-75pq-3xrq-9pc6"],"status":"published","title":"Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00269,"percentile":0.19223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-10-29T10:16:41Z","modified":"2026-11-05T21:28:21Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qpid-proton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.40.0-15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qpid-proton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.0-10","0.37.0-2","0.37.0-3","0.37.0-4","0.37.0-5","0.37.0-6","0.37.0-7","0.37.0-8","0.37.0-9"]},{"source":"osv","ecosystem":"Debian:13","package":"qpid-proton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.0-10","0.37.0-6","0.37.0-7","0.37.0-8","0.37.0-9"]},{"source":"osv","ecosystem":"Debian:14","package":"qpid-proton","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.0-10","0.37.0-6","0.37.0-7","0.37.0-8","0.37.0-9"]}],"products":[{"vendor":"apache software foundation","product":"apache qpid proton c"}],"references":[{"url":"https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/22"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105031","tags":["web"]},{"url":"https://github.com/advisories/GHSA-75pq-3xrq-9pc6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105031","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-105031","title":"Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T10:16:41.384Z","modified":"2026-11-05T21:28:21.353Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-05T22:55:18.50091Z"}],"euvd":[{"id":"EUVD-2026-112725","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T10:16:41Z","modified":"2026-11-05T21:28:21Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-05T22:02:07.885196Z"}],"ghsa":[{"id":"GHSA-75pq-3xrq-9pc6","title":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026...","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T12:30:36Z","modified":"2026-11-06T00:33:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-06T00:57:25.690752Z"}],"nvd":[{"id":"CVE-2026-105031","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T11:17:24.29Z","modified":"2026-11-05T22:17:42.63Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-05T23:57:22.428307Z"}],"osv":[{"id":"DEBIAN-CVE-2026-105031","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.    This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.    This issue does not affect the Win32 SChannel TLS implementation.    This issue affects Apache Qpid Proton C: through 0.40.0.    Users are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T11:17:24.29Z","modified":"2026-11-06T10:04:16.406599734Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"AZL-111748","title":"CVE-2026-105031 affecting package qpid-proton 0.40.0-15","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() \u0026 pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","status":"published","published":"2026-10-29T11:17:24Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"}]}}