---
id: "CVE-2026-115942"
kind: "vulnerability"
aliases: ["CVE-2026-115942"]
title: "Apache Qpid Proton C: misconfigured wildcard TLS certificate causes stack read overflow"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-qpid-proton", "messaging", "package", "tls"]
not_affected_if: ["rfc9525-wildcard-certificates"]
published_at: "2026-10-29T11:17:30+00:00"
first_seen_at: "2026-10-29T11:24:28+00:00"
updated_at: "2026-10-29T11:25:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115942", "first_seen_at": "2026-10-29T11:24:28+00:00"}]
---

# Apache Qpid Proton C: misconfigured wildcard TLS certificate causes stack read overflow

A misconfigured wildcard TLS certificate causes a stack read overflow in Apache Qpid Proton C through 0.40.0. The sources do not state what an attacker can get beyond reading past a stack buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Qpid Proton C version (for example `pkg-config --modversion libqpid-proton` or the version in your package manifest) and see whether it is `0.40.0` or older
- Check whether any wildcard TLS certificates in use are issued to the RFC 9525 standard; the sources say certificates issued to that standard are not affected

## Fix

- Apache Qpid Proton C: upgrade to `0.41.1`

## Timeline

- 2026-10-29T11:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115942

## From the sources

A misconfigured wildcard TLS certificate causes a stack read overflow.



This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.



This issue affects Apache Qpid Proton C: through 0.40.0.



Users are recommended to upgrade to version 0.41.1, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_