Live › vulnerability › CVE-2026-115942
A misconfigured wildcard TLS certificate causes a stack read overflow in Apache Qpid Proton C through 0.40.0. The sources do not state what an attacker can get beyond reading past a stack buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Applications that link Apache Qpid Proton C through 0.40.0 and handle wildcard TLS certificates that are not issued to the RFC 9525 standard. The sources say wildcard certificates issued to RFC 9525 are not affected, so teams using only such certificates can skip it. Exposure from the network side is not stated.
No product ranges from the sources yet.
pkg-config --modversion libqpid-proton or the version in your package manifest) and see whether it is 0.40.0 or older0.41.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A misconfigured wildcard TLS certificate causes a stack read overflow.
This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-115942")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.