A misconfigured wildcard TLS certificate that does not comply with RFC9525 can trigger a stack buffer overflow read during TLS handshake verification in Apache Qpid Proton C. The overflow allows an attacker to read memory contents from the process stack, potentially exposing sensitive information or facilitating further compromise. This weakness is classified as CWE‑125, a classic buffer error that exploits improper bounds checking.

Apache Software Foundation’s Apache Qpid Proton C is vulnerable in all releases through version 0.40.0. Users running any of these versions or earlier are affected and should upgrade to 0.41.1 or later, which contains the fix.

There is no publicly available EPSS data and the vulnerability is not listed in CISA KEV, indicating that it has not yet been exploited in the wild. However, the attack requires an active TLS connection using a non‑compliant wildcard certificate, which is a realistic scenario for misconfigured services. The CVSS score is not provided, but the nature of the flaw suggests a high impact if exploited. Organizations should treat this as a high‑risk vulnerability pending mitigation.