CVE-2026-105042 PUBLISHED

Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

Assigner: apache
Reserved: 02.10.2026 Published: 29.10.2026 Updated: 29.10.2026

A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Qpid Proton C
Versions Default: unaffected
  • affected from 0 to 0.40.0 (incl.)

Credits

  • zhangph@yandex.com finder
  • Gjoko Krstic <gjoko@zeroscience.mk> finder

References

Problem Types

  • CWE-674 Uncontrolled Recursion CWE