CVE-2026-44236

HighCVSS 7.1

Published: 17/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

39th percentile - higher than 39% of all known CVEs

Summary

In rabbitmq-c prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value, leading to a heap buffer overflow and memory corruption. This can cause denial of service and theoretically code execution.

Risk Assessment

An attacker can crash the rabbitmq-c client or potentially execute code, leading to unavailability or compromise of the application. The attack can be performed via a malicious AMQP server or an on-path attacker.

Recommendation

Update rabbitmq-c to version 0.16.0 or later. Until then, avoid connecting to untrusted AMQP servers and consider encrypting traffic.

Other vulnerabilities in rabbitmq-c

CVE-2026-44235Medium
rabbitmq-c before version 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, leading to an out-of-bounds read and process crash. The issue also occurs when AMQP traffic is not protected by TLS with certificate validation.

Original NVD description (English source)

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS