Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-44235rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read
Medium 6.5
In plain English
A medium-severity out-of-bounds read in rabbitmq-c from alanxz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | librabbitmq | 0.11.0-1+deb12u2 | DEBIAN-CVE-2026-44235 |
| Debian:13 | librabbitmq | 0.15.0-1+deb13u1 | DEBIAN-CVE-2026-44235 |
| Debian:14 | librabbitmq | 0.16.0-1 | DEBIAN-CVE-2026-44235 |
| Ubuntu:22.04:LTS | librabbitmq | 0.10.0-1ubuntu2.1 | USN-8437-1 |
| Ubuntu:22.04:LTS | librabbitmq | 0.10.0-1ubuntu2.2 | USN-8724-1 |
| Ubuntu:22.04:LTS | librabbitmq | 0.10.0-1ubuntu2.1 | UBUNTU-CVE-2026-44235 |
| Ubuntu:24.04:LTS | librabbitmq | 0.11.0-1ubuntu0.1 | UBUNTU-CVE-2026-44235 |
| Ubuntu:24.04:LTS | librabbitmq | 0.11.0-1ubuntu0.2 | USN-8724-1 |
| Ubuntu:24.04:LTS | librabbitmq | 0.11.0-1ubuntu0.1 | USN-8437-1 |
| Ubuntu:25.10 | librabbitmq | 0.15.0-1ubuntu0.25.10.1 | UBUNTU-CVE-2026-44235 |
| Ubuntu:25.10 | librabbitmq | 0.15.0-1ubuntu0.25.10.1 | USN-8437-1 |
| Ubuntu:26.04:LTS | librabbitmq | 0.15.0-1ubuntu0.26.04.1 | UBUNTU-CVE-2026-44235 |
| Ubuntu:26.04:LTS | librabbitmq | 0.15.0-1ubuntu0.26.04.1 | USN-8437-1 |
| Ubuntu:26.04:LTS | librabbitmq | 0.15.0-1ubuntu0.26.04.2 | USN-8724-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| alanxz | rabbitmq-c | < 0.16.0 |
Weakness: CWE-125, CWE-191 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-9mmv-r8g3-qp46 x_refsource_CONFIRM
- https://github.com/alanxz/rabbitmq-c/pull/878 x_refsource_MISC
- https://github.com/alanxz/rabbitmq-c/commit/1d3afbb056fee5cc9ea05680bf32288715d0d802 x_refsource_MISC
- https://github.com/alanxz/rabbitmq-c/releases/tag/v0.16.0 x_refsource_MISC