CVE-2026-105031criticalCWE-295

CVE-2026-105031: fallo crítico en Apache Qpid Proton C

Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Qpid Proton C+ Monitorear qpid-proton

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.1%
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Apache Software Foundation · Apache Qpid Proton C
CVEs relacionadas — Apache Qpid Proton C

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-114230CRITICALApache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesEPSS 0.3%CVE-2026-105042CRITICALApache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crashEPSS 0.2%CVE-2026-115942HIGHApache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readEPSS 0.1%