CVE-2026-61547

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1.

Security Fix(es):

CVE-2026-59986 is a security vulnerability affecting the librabbitmq library. Specific details of the vulnerability have not been disclosed. librabbitmq is the C client library for RabbitMQ messaging middleware.(CVE-2026-59986)

CVE-2026-61547 is a security vulnerability in librabbitmq (RabbitMQ C client library). Details of the vulnerability have not been disclosed yet, and all versions are affected.(CVE-2026-61547)

[Unknown description]

amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read). (CVE-2026-59986) Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY. (CVE-2026-61547)

It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read, resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)