CVE-2026-105042

CriticalCVSS 9.8/10Last modified Nov 5, 2026

Description

A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-674

Affected software

VendorProductVersions
Apache Software FoundationApache Qpid Proton C<= 0.40.0

References

Timeline

Published
Oct 29, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1050433.6MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cCVE-2026-1050448.5Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive SecCVE-2026-1050464.3Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.CVE-2026-1050484.0The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).CVE-2026-1050495.8Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLCVE-2026-1050507.1PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation CVE-2026-1050511.9Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sysCVE-2026-1050527.5IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker CVE-2026-1050555.3Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security CVE-2026-1050566.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecCVE-2026-1050575.3Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.CVE-2026-1050588.8Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
CVE-2026-105042: Critical severity, CVSS 9.8 | Vulnix