This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Qpid Proton C | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 29 Oct 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue. | |
| Title | Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames | |
| Weaknesses | CWE-305 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-10-29T11:09:06.927Z
Reserved: 2026-10-21T05:27:42.658Z
Link: CVE-2026-114230
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-29T11:17:28.210
Modified: 2026-10-29T11:17:28.210
Link: CVE-2026-114230
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-29T11:30:14Z