Vulnerability in Apache Qpid Proton C affecting OpenSSL TLS Implementation

CVE-2026-105031

What is CVE-2026-105031?

The Apache Qpid Proton C product contains a vulnerability within its OpenSSL TLS implementation. The issue arises from the pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs, which append to rather than replace the default system trust anchors. This may inadvertently allow for the acceptance of untrusted peer certificates, creating potential security risks. To mitigate this problem, users are advised to set the SSL_CERT_FILE environment variable to /dev/null as a temporary workaround. To ensure complete protection, it is highly recommended to upgrade to version 0.41.1 or later, where the issue has been resolved.

References