Live › vulnerability › CVE-2026-105042
A message body that is deeply nested and decoded by pn_message_body() can overflow the stack in Apache Qpid Proton C through 0.40.0. The result is a crash of the process that decodes the message.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Applications built on Apache Qpid Proton C through 0.40.0 that decode message bodies with pn_message_body(), especially those accepting messages from untrusted senders. Systems that do not use Qpid Proton C or do not decode message bodies this way can skip it. Sources do not say whether specific configurations are required.
No product ranges from the sources yet.
pkg-config --modversion libqpid-proton or your package manager.pn_message_body() on messages received from untrusted peers.0.41.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-105042")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.