Zero Radar
← feed
HighVulnerabilityCVE-2026-105042updated 29 Oct 2026, 11:22 UTC

Apache Qpid Proton C can crash from deeply nested message data

A specially crafted message with extremely deep nesting can make the messaging library crash. Anything that reads such messages could stop working until restarted.

Fixed in 0.41.1Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?Yes0.41.1 · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Unbounded recursion in pn_message_body() when decoding AMQP message bodies can overflow the stack and crash the process. Affects Apache Qpid Proton C through 0.40.0.

Why it is dangerous: A crash can interrupt message processing for services that receive untrusted AMQP messages, causing outages or denial of service.

Are you affected?

You are affected if you run Apache Qpid Proton C version 0.40.0 or earlier and decode AMQP message bodies with pn_message_body().

Apache Qpid Proton C through 0.40.0

What to do

  1. Upgrade Apache Qpid Proton C to version 0.41.1 or later
  2. Restart services that use the library after upgrading
  3. Check that your applications link against the updated library

Timeline

  1. 28 Oct 2026, 20:44 UTC
    Publicly disclosed
  2. 28 Oct 2026, 20:44 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 20:46 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 11:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-105042
Disclosed
28 Oct 2026, 20:44 UTC
On Zero Radar
28 Oct 2026, 20:46 UTC (2 min after disclosure)
Last change
29 Oct 2026, 11:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Qpid Proton C can crash from deeply nested message data · Zero Radar