CVE-2026-105031 Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
CriticalCVSS 9.1
EPSS 0.27%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.
This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.
This issue does not affect the Win32 SChannel TLS implementation.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache.org/qpid-proton | <= 0.40.0 | No fix listed |
| redhat/qpid-proton(Red Hat:amq_clients:2023) | All versions | No fix listed |
| redhat/qpid-proton(Red Hat:openstack:13) | All versions | No fix listed |
| redhat/qpid-proton(Red Hat:openstack:16.2) | All versions | No fix listed |
| redhat/qpid-proton(Red Hat:openstack:17.1) | All versions | No fix listed |
| redhat/qpid-proton(Red Hat:service_interconnect:2) | All versions | No fix listed |
| debian/qpid-proton(Debian:12) | All versions | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-10 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-2 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-3 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-4 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-5 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-6 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-7 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-8 | No fix listed |
| debian/qpid-proton(Debian:12) | = 0.37.0-9 | No fix listed |
| debian/qpid-proton(Debian:13) | All versions | No fix listed |
| debian/qpid-proton(Debian:13) | = 0.37.0-10 | No fix listed |
| debian/qpid-proton(Debian:13) | = 0.37.0-6 | No fix listed |
| debian/qpid-proton(Debian:13) | = 0.37.0-7 | No fix listed |
| debian/qpid-proton(Debian:13) | = 0.37.0-8 | No fix listed |
| debian/qpid-proton(Debian:13) | = 0.37.0-9 | No fix listed |
| debian/qpid-proton(Debian:14) | All versions | No fix listed |
| debian/qpid-proton(Debian:14) | = 0.37.0-10 | No fix listed |
| debian/qpid-proton(Debian:14) | = 0.37.0-6 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qpid-proton(Debian:14) | = 0.37.0-7 | No fix listed |
| debian/qpid-proton(Debian:14) | = 0.37.0-8 | No fix listed |
| debian/qpid-proton(Debian:14) | = 0.37.0-9 | No fix listed |
References
- lists.apache.org vendor-advisory
- www.openwall.com
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2563304 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-105031 vendor-advisory
- bugs.debian.org issue-tracking