Apache Qpid Proton CVE-2026-115942

Exploitation requires a Qpid Proton C client at or below version 0.40.0 to perform TLS peer hostname verification against a certificate whose wildcard entry does not conform to RFC9525; the attacker must control the TLS peer (a malicious server, or a MITM position injecting the crafted certificate) that the victim establishes a connection to. Limiting factors: only non-compliant wildcard certificates trigger the over-read (certificates that comply with RFC9525 are unaffected, and the fix simply rejects non-compliant ones); the victim client must initiate or accept the TLS connection to the attacker-controlled endpoint with hostname verification active; and only versions through 0.40.0 are vulnerable, so any deployment on 0.41.1 or later is not exploitable.

This is a genuinely low-priority issue, and the available signals are consistent on that point rather than conflicting. No source supplies a CVSS score or vector (NVD, Apache, and oss-security all show N/A), so attack vector, complexity, and privilege requirements are not vendor-confirmed and must be inferred from the description. There is no EPSS score, no CISA KEV listing, and no PoC or exploit reference in any of the provided links - the references are purely informational advisories (oss-security post, Apache JIRA PROTON-2974, project homepage). The vuln.today decision label is 'awaiting_data', reinforcing that no urgency signal (KEV/EPSS/SSVC) is present. Apache itself rated this 'low'. The flaw is a stack buffer over-read triggered only when a Qpid Proton C client verifies a peer TLS certificate bearing a wildcard entry that does not comply with RFC9525, which means the attacker must control or impersonate the TLS peer the victim connects to, and the realistic worst case is a client-side crash (denial of service) rather than code execution or data theft. Because no CVSS vector is provided, authentication requirements are not confirmed from available data; this is best described as exploitable by remote attackers who control a malicious or misconfigured TLS endpoint. Bottom line: a real but low-impact, condition-dependent bug - patch during normal maintenance, not an emergency.

An attacker who operates (or man-in-the-middles into) an AMQP/TLS server endpoint presents a certificate containing a wildcard SAN or CN that violates RFC9525. When a Qpid Proton C client at or below version 0.40.0 performs its home-grown peer hostname verification, the verification routine reads past the bounds of a stack buffer, most plausibly crashing the client process. No public exploit code is identified at time of analysis; the only references are vendor and oss-security advisories.