CVE-2026-105042EUVD-2026-112726GHSA-FR7G-693Q-6W7X
Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Apache Qpid Proton C, an AMQP messaging library, is affected by this vulnerability. A deeply nested AMQP message body decoded through its message-body parsing function can exhaust the stack and crash the application using the library.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- Apache Software Foundation Apache Qpid Proton C
through 0.40.0