CVE-2026-44235: rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read
Last updated 4 September 2026
Other sources
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput() in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed per-frame fields, and FOOTERSIZE from state->targetsize without first checking the minimum frame length. The wrapped encoded.len value is passed through amqpdecodeproperties() to amqpdecodetableinternal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.11.0-1+deb12u2Fixed in 0.11.0-1+deb12u3Fixed in 0.15.0-1+deb13u1Fixed in 0.15.0-1+deb13u2Fixed in 0.17.0-1 - Upgrade
Upgrade
rabbitmq-cto a version that resolves this vulnerability.Fixed in 0.16.0 - Compensating control
Ensure AMQP traffic is protected by TLS with certificate validation to prevent an on-path attacker from triggering the issue when traffic is not protected by TLS with certificate validation.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using rabbitmq-c versions before 0.16.0 are exposed when they connect to a malicious AMQP server. Connections whose AMQP traffic is not protected by TLS with certificate validation can also be attacked by an on-path attacker.
What must an attacker do to trigger the vulnerability?
The attacker must send an undersized AMQP HEADER or METHOD frame while the client is logging in. No client privileges are required, but exploitation requires interaction with the client through its AMQP connection or interception of an inadequately protected connection.
What is the practical impact?
The demonstrated result is an out-of-bounds read that crashes the affected process, causing denial of service. Reliable memory disclosure and code execution have not been shown.
What can be done if upgrading is not immediately possible?
Use TLS with certificate validation for AMQP connections to reduce exposure to on-path attackers. This does not protect a client that connects directly to a malicious AMQP server; upgrading to 0.16.0 is the available fix.