Authentication Bypass by Primary Weakness Affecting qpid-proton package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN14-QPIDPROTON-21785369
- published29 Oct 2026
- disclosed29 Oct 2026
Introduced: 29 Oct 2026
NewCVE-2026-114230 (opens in a new tab)How to fix?
There is no fixed version for Debian:14 qpid-proton.
NVD Description
Note: Versions mentioned in the description apply only to the upstream qpid-proton package and not the qpid-proton package as distributed by Debian.
See How to fix? for Debian:14 relevant fixed versions and status.
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.