Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115942— Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Quick assessment

Affected

Apache Software Foundation Apache Qpid Proton C

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

一个配置错误的通配符 TLS 证书会导致栈读取溢出漏洞。该问题不影响任何遵循 RFC 9525 标准签发的通配符证书——修复方案仅接受符合该标准的证书。受影响的产品为 Apache Qpid Proton C，版本范围涵盖 0.40.0 及之前所有版本。建议用户升级至 0.41.1 版本，该版本已修复此问题。

AI Predicted 7.5 Difficulty: Moderate Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Oct 29, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

Source: CVE Program / CVE List V5

Vulnerability Description

A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Qpid Proton C	0 ~ 0.40.0	-

II. Public POCs for CVE-2026-115942

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115942

请登录查看更多情报信息。

Other References for CVE-2026-115942 (1)

https://lists.apache.org/thread.html/5z8x4c1939rxs5hod7q7gvgdmjd7p7pt vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-115942

Same Patch Batch · Apache Software Foundation · 2026-10-29 · 5 CVEs total

CVE-2026-71569	4.8 MEDIUM	Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresse
CVE-2026-114230		Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as
CVE-2026-105042		Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
CVE-2026-105031		Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate au

IV. Related Vulnerabilities

Same product: Apache Qpid Proton C

Same vendor: Apache Software Foundation

Same weakness: CWE-125