CVE-2026-115942 PUBLISHED

Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Assigner: apache
Reserved: 23.10.2026 Published: 29.10.2026 Updated: 29.10.2026

A misconfigured wildcard TLS certificate causes a stack read overflow.

This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Qpid Proton C
Versions Default: unaffected
  • affected from 0 to 0.40.0 (incl.)

Credits

  • zhangph@yandex.com finder

References

Problem Types

  • CWE-125 Out-of-bounds read CWE