← Advisories

Apache Qpid Proton C API 0.40.0 Remote Stack Overflow

Medium
Advisory ID
ZSL-2026-6031
Release Date
23 October 2026
Vendor
The Apache Software Foundation - https://www.apache.org
Affected Version
0.40.0
CVE
N/A
Tested On
Microsoft Windows 10 (x86_64), gcc 15.2.0 (MSYS2 UCRT64)
Summary

Qpid Proton is a high-performance, lightweight messaging library. It can be used in the widest range of messaging applications, including brokers, client libraries, routers, bridges, proxies, and more. Proton makes it trivial to integrate with the AMQP 1.0 ecosystem from any platform, environment, or language

Description

Apache Qpid Proton-C suffers from a denial-of-service vulnerability caused by unbounded recursion in its AMQP decoder. The decoder recurses once per nested compound type with no depth limit, so a remote peer can send a small, deeply nested AMQP value and exhaust the stack, crashing any application built on the library before authentication. This allows a remote, unauthenticated peer to cause a denial of service.

Proof of Concept
Disclosure Timeline
13.08.2026Vulnerability discovered.
19.08.2026Contact with the vendor.
20.08.2026Vendor forwards details to appropriate PMC.
14.09.2026Silent fix merged to main.
24.09.2026Qpid PMC has received the report and is investigating / discussing. Will follow up later accepting or rejecting the report.
30.09.2026Replied to the vendor.
09.10.2026Vendor silently released version 0.41.1 to address this issue.
23.10.2026Uncoordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
23.10.2026Initial release