CVE-2026-105042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105042", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-02T21:31:42.230Z", "datePublished": "2026-10-29T10:17:20.853Z", "dateUpdated": "2026-11-05T21:29:09.604Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:17:20.853Z"}, "title": "Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash", "problemTypes": [{"descriptions": [{"description": "CWE-674 Uncontrolled Recursion", "lang": "en", "cweId": "CWE-674", "type": "CWE"}]}], "source": {"defect": ["PROTON-2976"], "discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "packageURL": "pkg:software-id/apache.org/qpid-proton", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.40.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "zhangph@yandex.com", "type": "finder"}, {"lang": "en", "value": "Gjoko Krstic <gjoko@zeroscience.mk>", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:08:30.677Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:28:49.713769Z", "id": "CVE-2026-105042", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:29:09.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:08:30.677Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-105042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:28:49.713769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:29:03.573Z"}}], "cna": {"title": "Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash", "source": {"defect": ["PROTON-2976"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "zhangph@yandex.com"}, {"lang": "en", "type": "finder", "value": "Gjoko Krstic <gjoko@zeroscience.mk>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.40.0"}], "packageURL": "pkg:software-id/apache.org/qpid-proton", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:17:20.853Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105042", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:29:09.604Z", "dateReserved": "2026-10-02T21:31:42.230Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-29T10:17:20.853Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:software-id/apache.org/qpid-proton", "product": "Apache Qpid Proton C", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "0.40.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}], "id": "CVE-2026-105042", "lastModified": "2026-11-05T22:17:42.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105042", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:28:49.713769Z", "version": "2.0.3"}}]}, "published": "2026-10-29T11:17:24.410", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/23"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "qpid-proton-c: qpid-proton-c: Denial of Service via stack overflow in pn_message_body()", "id": "2563306", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563306"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.\nThis issue affects Apache Qpid Proton C: through 0.40.0.\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "A flaw was found in Apache Qpid Proton C. An attacker can supply a specially crafted message containing deeply nested data structures that, when decoded by the pn_message_body() function, triggers a stack overflow. This failure causes the application to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-105042", "package_state": [{"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "python39-qpid-proton", "product_name": "Red Hat AMQ Clients"}, {"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "python3-qpid-proton", "product_name": "Red Hat AMQ Clients"}, {"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat AMQ Clients"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-kuryr-cni-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-kuryr-controller-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "rhosp13/openstack-ceilometer-notification", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "rhosp13/openstack-qdrouterd", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-ceilometer-notification", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-qdrouterd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-ceilometer-notification", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-qdrouterd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:service_interconnect:2", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat Service Interconnect 2"}], "public_date": "2026-10-29T10:17:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105042\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105042\nhttps://lists.apache.org/thread.html/7v54gx7o1ptxcz3h9549w3h9oxo3ns28"], "statement": "Red Hat has rated this vulnerability as Important severity because unauthenticated remote network actors can trigger a denial of service against services consuming AMQP traffic without requiring privileges or user interaction. In typical deployments, messaging daemons and integration endpoints that process untrusted external payloads using the Qpid Proton C library will terminate unexpectedly when handling recursively formatted structures. Although the crash causes process termination, the impact is strictly confined to service availability and does not compromise system confidentiality or integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.40.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Qpid Proton C", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "qpid_proton-c", "vendor": "apache"}], "created": "2026-10-29T12:00:19.367937+00:00", "updated": "2026-11-05T23:30:16.315454+00:00", "vendors": ["apache", "apache$PRODUCT$qpid_proton-c"]}