{"id":"CVE-2026-105031","aliases":[],"cve":{"records":[{"id":"CVE-2026-105031","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-02T21:28:25.620Z","published":"2026-10-29T10:16:41.384Z","modified":"2026-10-29T11:08:28.567Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-29T10:16:41.384Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-29T11:08:28.567Z"}],"references":[{"url":"https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/22","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-295","description":"CWE-295 Improper certificate validation","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.","titleSource":"apache","descriptionSource":"apache","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","score":null,"severity":"unknown","published":"2026-10-29T10:16:41.384Z","modified":"2026-10-29T11:08:28.567Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Qpid Proton C","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.40.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/qpid-proton","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-105031"}],"remediation":[],"references":["https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4","http://www.openwall.com/lists/oss-security/2026/10/28/22"],"sources":[{"name":"CVE","id":"CVE-2026-105031","modified":"2026-10-29T11:08:28.567Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-105031"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-29T14:14:21.391Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T01:00:32.474Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T10:40:31.958Z","attemptedAt":"2026-10-29T10:40:31.958Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T10:40:32.589Z","attemptedAt":"2026-10-29T10:40:32.589Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T10:40:32.436Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T10:40:31.958Z","attemptedAt":"2026-10-29T10:40:31.958Z"}],"evidence":[],"aiSummary":null}