CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors

Description

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null. This issue does not affect the Win32 SChannel TLS implementation. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Text from the CVE.org record (apache).

How do I fix CVE-2026-105031?

Upgrade to a fixed release named by the vendor:

• Apache: 0.41.1
• Red Hat: 0.41.1

• Users are recommended to upgrade to version 0.41.1, which fixes the issue. (Apache)
• Configure the environment of affected processes to override the default OpenSSL certificate store path to `/dev/null`. This ensures that only explicitly configured CA certificates are trusted. For standalone or shell-executed processes: ``` export SSL_CERT_FILE=/dev/null ``` For systemd-managed services, create or edit a drop-in override (e.g., using `systemctl edit `): ``` [Service] Environment="SSL_CERT_FILE=/dev/null" ``` Apply the changes by reloading systemd and restarting the service: ``` systemctl daemon-reload systemctl restart ``` Caveats: Setting `SSL_CERT_FILE=/dev/null` disables loading of standard operating system CA certificates. Any connection depending on system-wide root CAs will fail certificate verification unless explicitly added to the application's trust store. Warning: Restarting services will terminate active network connections and interrupt in-flight message delivery. (Red Hat)