CVE-2026-105042criticalCWE-674

CVE-2026-105042: fallo crítico en Apache Qpid Proton C

Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Qpid Proton C+ Monitorear qpid-proton

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.2%
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Apache Software Foundation · Apache Qpid Proton C
CVEs relacionadas — Apache Qpid Proton C

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-114230CRITICALApache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL framesEPSS 0.3%CVE-2026-115942HIGHApache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow readEPSS 0.1%CVE-2026-105031CRITICALApache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.EPSS 0.1%