CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

• CWE-295

• http://www.openwall.com/lists/oss-security/2016/07/15/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91788Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036316Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E
• http://www.openwall.com/lists/oss-security/2016/07/15/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/91788Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036316Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/914424e4d798a340f523b6169aaf39b626971d9bb00fcdeb1d5d6c0d%40%3Ccommits.qpid.apache.org%3E

Published

May 2, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4461Apache Struts 2.x before 2.3.29 allows remote attackers to e…
• CVE-2016-4462By manipulating the URL parameter externalLoginKey, a malici…
• CVE-2016-4463Stack-based buffer overflow in Apache Xerces-C++ before 3.1.…
• CVE-2016-4464The application plugins in Apache CXF Fediz 1.2.x before 1.2…
• CVE-2016-4465The URLValidator class in Apache Struts 2 2.3.20 through 2.3…
• CVE-2016-4466Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-4468SQL injection vulnerability in Pivotal Cloud Foundry (PCF) b…
• CVE-2016-4469Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2016-4470The key_reject_and_link function in security/keys/key.c in t…
• CVE-2016-4471ManageIQ in CloudForms before 4.1 allows remote authenticate…
• CVE-2016-4472The overflow protection in Expat is removed by compilers wit…8.1
• CVE-2016-4473/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote…