Bug 2563306 (CVE-2026-105042)

Summary: CVE-2026-105042 qpid-proton-c: qpid-proton-c: Denial of Service via stack overflow in pn_message_body()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, ansmith, aos-team-art-private, asdas, dpaolell, eglynn, jbritton, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbiarnes, mburns, mgarciac, pjindal, ppalepu, ppostler, prdhamdh, rgodfrey, sghai, sidsharm, suppawar, vlaad
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Qpid Proton C. An attacker can supply a specially crafted message containing deeply nested data structures that, when decoded by the pn_message_body() function, triggers a stack overflow. This failure causes the application to crash, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 10:32:05 UTC 
A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.



This issue affects Apache Qpid Proton C: through 0.40.0.



Users are recommended to upgrade to version 0.41.1, which fixes the issue.