CVE-2026-105042

Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash

State: Published
Severity: Not scored
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 2, 2026

Read the record on cve.org

Description

A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Scores

The record has no CVSS score.

Weaknesses

CWE-674 Uncontrolled Recursion

Affected Products

Product	Versions
Apache Qpid Proton CApache Software Foundation	0.40.0 and earlierAffected

References

https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28vendor-advisory
http://www.openwall.com/lists/oss-security/2026/10/28/23

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.