External risk intelligence

Apache Qpid Proton Stack Overflow Denial of Service

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-105042

Apache Qpid Proton is a messaging library used to build applications and messaging systems. While it can be integrated into internet-facing services, it is primarily a developer-focused communication protocol library. Its exposure depends entirely on the specific application architecture, as it is not inherently a public-facing service or appliance by default.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Apache Qpid Proton C messaging library, discovered in versions prior to 0.41.1. The issue stems from a deeply nested message body that can cause a stack overflow, leading to a crash. While not a direct internet-facing service, its use in messaging systems means that if an affected application is accessible externally, this vulnerability could be exploited.

A messaging library can crash with specially crafted messages.
It affects systems using Apache Qpid Proton C messaging.
Confirm relevance and potential exposure in your messaging systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted, deeply nested message to an application that uses the vulnerable component. The application's message decoding function, `pn_message_body()`, would attempt to process this message, leading to a stack overflow and subsequent crash.

Entry Condition: Network access to a vulnerable application.
Trigger Point: Sending a deeply nested message.
Resulting Risk: Application crash.

Live Threat

Current exploitation, exposure, and threat context

A deeply nested message body processed by pn_message_body() could lead to a stack overflow and crash the application. This could affect the availability of services that rely on the affected Apache Qpid Proton C library when processing specially crafted, deeply nested messages.

Application availability.
Malformed nested messages.
Service crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Apache Qpid Proton C library's stack overflow vulnerability necessitates action from application owners and infrastructure teams responsible for messaging systems. The first practical step is to identify all instances of the affected software, determine their business criticality and network exposure, and then confirm the accountable owner for remediation planning.

Application owners should own this issue.
Verify messaging system exposure.
Plan upgrades during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Qpid Proton C?

Apache Qpid Proton C is a messaging library that developers use to build applications capable of sending and receiving data over messaging systems. It provides the low-level building blocks for communication protocols, enabling software components to talk to each other reliably within distributed environments.

What does CWE-674 mean for CVE-2026-105042?

CWE-674 refers to Uncontrolled Recursion. In the context of CVE-2026-105042, this means the software's decoding function, pn_message_body(), enters a recursive cycle that consumes too much memory on the program's stack. When the data structure is too deeply nested, the system runs out of stack space, leading to a crash.

How can an attacker trigger this stack overflow?

An attacker triggers this vulnerability by sending a specially crafted message containing an unusually deep level of nesting to an application using the vulnerable library. Simply sending standard or valid messages will not trigger the bug; the crash only occurs when the decoding process attempts to parse the malicious, deeply nested structure.

Is my system at risk if it uses this library?

According to Halo Surface Signal, your risk depends on your specific application architecture. Since this is a developer library rather than a standalone service, it is not always internet-facing. You should assess whether your messaging application is accessible from an external network, as this increases the likelihood that a malicious message could reach the vulnerable component.

What should I do to address this vulnerability?

The primary step is to identify all software and services in your environment that utilize Apache Qpid Proton C versions through 0.40.0. Once you have located these instances, coordinate with the respective application owners to schedule an upgrade to version 0.41.1, which contains the necessary fix for this issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.