{"id":"CVE-2026-44236","aliases":["ALSA-2026:75582","ALSA-2026:82094","ALSA-2026:84795","AZL-105087","BIT-rabbitmq-c-2026-44236","CLSA-2026-1792594240","CLSA-2026-1792765036","DEBIAN-CVE-2026-44236","EUVD-2026-82332","GHSA-jh48-qjf5-fx5v","MGASA-2026-0314","OESA-2026-2713","RHSA-2026:75582","RHSA-2026:82094","RHSA-2026:84795","RLSA-2026:75582","RLSA-2026:82094","RLSA-2026:84795","RLSA-2026:98467","UBUNTU-CVE-2026-44236","USN-8437-1","USN-8724-1"],"status":"published","title":"rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00403,"percentile":0.34962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-06-11T00:00:00Z","modified":"2026-11-12T00:30:03Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"librabbitmq-devel","fixed_in":["0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librabbitmq","fixed_in":["0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librabbitmq-devel","fixed_in":["0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"librabbitmq-tools","fixed_in":["0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"librabbitmq","fixed_in":["0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"librabbitmq-devel","fixed_in":["0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"librabbitmq-tools","fixed_in":["0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"rabbitmq-c","fixed_in":["0.16.0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq","fixed_in":["0.11.0-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq-devel","fixed_in":["0.11.0-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq-tools","fixed_in":["0.11.0-5.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq","fixed_in":["0.11.0-7.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq-devel","fixed_in":["0.11.0-7.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq-tools","fixed_in":["0.11.0-7.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"librabbitmq","fixed_in":["0.11.0-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librabbitmq","fixed_in":["0.15.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librabbitmq","fixed_in":["0.16.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-debugsource","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-tools","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-debugsource","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-debugsource","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-devel","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-debuginfo","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-debugsource","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-tools","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-debuginfo","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-debugsource","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-devel","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-debuginfo","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-debugsource","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-tools","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-tools-debuginfo","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-devel","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"librabbitmq","fixed_in":["0:0.9.0-6.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"librabbitmq","fixed_in":["0:0.11.0-7.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"librabbitmq","fixed_in":["0:0.14.0-3.el10_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"librabbitmq","fixed_in":["0.4.1-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librabbitmq","fixed_in":["0.7.1-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librabbitmq","fixed_in":["0.8.0-1ubuntu0.18.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"librabbitmq","fixed_in":["0.10.0-1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"librabbitmq","fixed_in":["0.10.0-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"librabbitmq","fixed_in":["0.11.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"librabbitmq","fixed_in":["0.15.0-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"librabbitmq","fixed_in":["0.15.0-1ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rabbitmq-c","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.16.0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-5.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-7.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1+deb12u2"}]}],"versions":["0.11.0-1","0.11.0-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1+deb13u1"}]}],"versions":["0.15.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-1"}]}],"versions":["0.15.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-2.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-8.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-10.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.0-3.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"librabbitmq-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.0-6.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-7.el9_8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu0.1~esm2"}]}],"versions":["0.3.0-1","0.4.1-1","0.4.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-1ubuntu0.2+esm1"}]}],"versions":["0.5.2-2","0.7.1-1","0.7.1-1ubuntu0.1","0.7.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1ubuntu0.18.04.2+esm1"}]}],"versions":["0.8.0-1","0.8.0-1build1","0.8.0-1ubuntu0.18.04.1","0.8.0-1ubuntu0.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu0.20.04.1~esm1"}]}],"versions":["0.9.0-0.2","0.9.0-0.2ubuntu1","0.10.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu2.1"}]}],"versions":["0.10.0-1","0.10.0-1build1","0.10.0-1ubuntu1","0.10.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1ubuntu0.1"}]}],"versions":["0.11.0-1","0.11.0-1build1","0.11.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu0.25.10.1"}]}],"versions":["0.15.0-1","0.15.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu0.26.04.1"}]}],"versions":["0.15.0-1build1","0.15.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu2.1"}]}],"versions":["0.10.0-1","0.10.0-1build1","0.10.0-1ubuntu1","0.10.0-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1ubuntu0.1"}]}],"versions":["0.11.0-1","0.11.0-1build1","0.11.0-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu0.25.10.1"}]}],"versions":["0.15.0-1","0.15.0-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu0.26.04.1"}]}],"versions":["0.15.0-1build1","0.15.0-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-1ubuntu0.1~esm2"}]}],"versions":["0.3.0-1","0.4.1-1","0.4.1-1ubuntu0.1~esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.1-1ubuntu0.2+esm1"}]}],"versions":["0.5.2-2","0.7.1-1","0.7.1-1ubuntu0.1","0.7.1-1ubuntu0.2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1ubuntu0.18.04.2+esm1"}]}],"versions":["0.8.0-1","0.8.0-1build1","0.8.0-1ubuntu0.18.04.1","0.8.0-1ubuntu0.18.04.2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu0.20.04.1~esm1"}]}],"versions":["0.9.0-0.2","0.9.0-0.2ubuntu1","0.10.0-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu2.2"}]}],"versions":["0.10.0-1","0.10.0-1build1","0.10.0-1ubuntu1","0.10.0-1ubuntu2","0.10.0-1ubuntu2.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-1ubuntu0.2"}]}],"versions":["0.11.0-1","0.11.0-1build1","0.11.0-1build2","0.11.0-1ubuntu0.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"librabbitmq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-1ubuntu0.26.04.2"}]}],"versions":["0.15.0-1build1","0.15.0-1build2","0.15.0-1ubuntu0.26.04.1"],"bundled":5}],"products":[{"vendor":"alanxz","product":"rabbitmq-c"}],"references":[{"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jh48-qjf5-fx5v","tags":["x_refsource_CONFIRM","exploit","web","advisory","article","report"]},{"url":"https://github.com/alanxz/rabbitmq-c/pull/879","tags":["x_refsource_MISC","web","fix","article"]},{"url":"https://github.com/alanxz/rabbitmq-c/commit/4777d0b5c58cb02966a04a85832436bd66ed5d1f","tags":["x_refsource_MISC","web","fix","article"]},{"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.16.0","tags":["x_refsource_MISC","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75582","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44236","tags":["report"]},{"url":"https://bugzilla.redhat.com/2536500","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-75582.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82094","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-82094.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84795","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-84795.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44236","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792594240.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792765036.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44236.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44236","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0314.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35702","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00254.html","tags":["web"]},{"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-9mmv-r8g3-qp46","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RVOR7C3KDMOVLKB4FNMSD3YNXP3MG4YD/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8437-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2713","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536500","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75582.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44236","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82094.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84795.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:75582","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:82094","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84795","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98467","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98467","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44236","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8724-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-35789","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61547","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44236","title":"rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T17:04:18.803Z","modified":"2026-09-21T20:59:56.472Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-82332","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T17:04:18Z","modified":"2026-09-21T20:59:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:03.79222Z"}],"nvd":[{"id":"CVE-2026-44236","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T18:16:44.503Z","modified":"2026-09-24T15:02:58.307Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-44236","title":"rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T17:04:18.803Z","modified":"2026-10-28T11:10:52.485482019Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-44236","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T18:16:44.503Z","modified":"2026-09-25T08:47:32.245974121Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"OESA-2026-2713","title":"librabbitmq security update","description":"This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1.\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-44235)\n\n(CVE-2026-44236)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:06.151630948Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:75582","title":"Red Hat Security Advisory: librabbitmq security update","status":"published","published":"2026-10-05T10:11:15Z","modified":"2026-10-20T10:15:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:82094","title":"Red Hat Security Advisory: librabbitmq security update","status":"published","published":"2026-10-14T10:32:41Z","modified":"2026-10-20T10:16:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84795","title":"Red Hat Security Advisory: librabbitmq security update","status":"published","published":"2026-10-20T10:17:49Z","modified":"2026-10-20T10:32:24.53974528Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:75582","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.\n\nSecurity Fix(es):\n\n* rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-06T06:01:13.392384Z","modified":"2026-10-06T06:45:02.585585729Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:82094","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.\n\nSecurity Fix(es):\n\n* rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-14T06:30:05.473043Z","modified":"2026-10-14T07:00:03.752867791Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:84795","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.\n\nSecurity Fix(es):\n\n* rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:37.450619676Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98467","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.\n\nSecurity Fix(es):\n\n* rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:12.119552Z","modified":"2026-11-12T00:30:03.618645608Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-44236","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-09-24T02:00:16.880157487Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"ALSA-2026:75582","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.  \n\nSecurity Fix(es):  \n\n  * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-05T00:00:00Z","modified":"2026-10-29T11:02:29.691794791Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:82094","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.  \n\nSecurity Fix(es):  \n\n  * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-29T11:32:38.217488771Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:84795","title":"Important: librabbitmq security update","description":"The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1.  \n\nSecurity Fix(es):  \n\n  * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:01.756477511Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-105087","title":"CVE-2026-44236 affecting package librabbitmq 0.14.0-1","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-17T18:16:44Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"BIT-rabbitmq-c-2026-44236","title":"rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.","status":"published","published":"2026-09-29T08:56:07.627Z","modified":"2026-09-29T10:10:44.586000005Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1792594240","title":"librabbitmq: Fix of CVE-2026-44236","description":"- CVE-2026-44236: A broker could negotiate frame_max below the AMQP\n  minimum, undersizing the client's outbound frame buffer and causing\n  memory corruption","status":"published","published":"2026-10-21T14:50:51Z","modified":"2026-10-26T09:31:03.179042863Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792765036","title":"librabbitmq: Fix of CVE-2026-44236","description":"- CVE-2026-44236: amqp_tune_connection accepted a frame_max below the\n  AMQP minimum (4096), allowing undersized frame buffers and memory\n  corruption","status":"published","published":"2026-10-23T14:17:26Z","modified":"2026-10-26T09:31:37.103299882Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0314","title":"Updated librabbitmq packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nAn issue was discovered in the C AMQP client library (aka rabbitmq-c)\nthrough 0.13.0 for RabbitMQ. Credentials can only be entered on the\ncommand line (e.g., for amqp-publish or amqp-consume) and are thus\nvisible to local attackers by listing a process and its arguments.\n(CVE-2023-35789)\nsize_t underflow in AMQP frame length computation leads to out-of-bounds\nread in rabbitmq-c. (CVE-2026-44235)\nHeap buffer overflow in AMQP login handshake via undersized\nconnection.tune.frame_max. (CVE-2026-44236)\n","status":"published","published":"2026-08-03T18:47:23Z","modified":"2026-08-03T19:00:05.541827422Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8437-1","title":"librabbitmq vulnerabilities","description":"It was discovered that rabbitmq-c exposed credentials in command-line\narguments under certain circumstances. A local attacker could possibly use\nthis issue to obtain sensitive information. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)\n\nIt was discovered that rabbitmq-c incorrectly handled AMQP frame lengths\nunder certain circumstances, which could lead to an out-of-bounds read. A\nremote attacker could possibly use this issue to cause rabbitmq-c to crash,\nresulting in a denial of service. (CVE-2026-44235)\n\nIt was discovered that rabbitmq-c incorrectly handled AMQP login handshakes\nunder certain circumstances, which could lead to a heap buffer overflow. A\nremote attacker could possibly use this issue to cause rabbitmq-c to crash,\nresulting in a denial of service, or execute arbitrary code.\n(CVE-2026-44236)","status":"published","published":"2026-06-16T14:48:17Z","modified":"2026-09-21T10:00:34.081438884Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8724-1","title":"librabbitmq vulnerabilities","description":"It was discovered that the rabbitmq-c command-line tools only accepted\ncredentials on the command line, making them visible to other local users\nthrough the process list. An attacker could possibly use this to obtain\nsensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)\n\nIt was discovered that rabbitmq-c did not correctly compute AMQP frame\nlengths, leading to a size_t underflow. A remote attacker could possibly\nuse this to cause rabbitmq-c to crash, resulting in a denial of service, or\npossibly expose sensitive information. This issue only affected Ubuntu\n14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2026-44235)\n\nIt was discovered that rabbitmq-c did not properly validate the frame size\nduring the AMQP login handshake. A remote attacker could possibly use this\nto cause a heap buffer overflow, resulting in a denial of service or\npossibly the execution of arbitrary code. This issue only affected Ubuntu\n14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2026-44236)\n\nIt was discovered that rabbitmq-c did not correctly validate the length of\ndecoded bytes fields, leading to an integer overflow in a bounds check on\n32-bit systems. A remote attacker controlling a broker, or able to\nintercept an unencrypted connection, could possibly use this to cause an\nout-of-bounds read, resulting in a denial of service or the exposure of\nsensitive information. (CVE-2026-59986)\n\nIt was discovered that rabbitmq-c did not validate the body fragment length\nwhen serialising an AMQP body frame with the amqp_send_frame() API. An\nattacker could possibly use this to cause a heap buffer overflow, resulting\nin a denial of service (application crash) or possibly the execution of\narbitrary code. This issue did not affect Ubuntu 14.04 LTS.\n(CVE-2026-61547)","status":"published","published":"2026-09-03T15:51:03Z","modified":"2026-09-21T10:00:32.721734371Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}