Bug 2563304 (CVE-2026-105031)

Summary:	CVE-2026-105031 qpid-proton: qpid-proton: improper certificate validation via retention of default system trust anchors
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ansmith, eglynn, jbritton, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, pjindal, rgodfrey
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in qpid-proton. When configuring custom trusted certificates with the OpenSSL Transport Layer Security (TLS) implementation, the library appends the certificates to default system trust anchors instead of replacing them. This improper certificate validation can allow a remote attacker presenting a certificate issued by any standard system Certificate Authority (CA) to be trusted by the application, potentially permitting unauthorized connections or interception of communications.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2566138, 2566139
Bug Blocks:

Description OSIDB Bzimport 2026-10-29 10:31:41 UTC

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.



This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.



This issue does not affect the Win32 SChannel TLS implementation.



This issue affects Apache Qpid Proton C: through 0.40.0.



Users are recommended to upgrade to version 0.41.1, which fixes the issue.