CVE-2026-44236: rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max
Last updated 4 September 2026
Other sources
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin(), and rabbitmq-c accepts the value in amqplogininner() in librabbitmq/amqpsocket.c. amqptuneconnection() in librabbitmq/amqpconnection.c uses framemax to reallocate the outbound buffer without enforcing AMQPFRAMEMINSIZE. Immediate serialization of connection.tune-ok through amqpframetobytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.11.0-1+deb12u2Fixed in 0.11.0-1+deb12u3Fixed in 0.15.0-1+deb13u1Fixed in 0.15.0-1+deb13u2Fixed in 0.17.0-1 - Upgrade
Upgrade
rabbitmq-cto a version that resolves this vulnerability.Fixed in 0.16.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious AMQP server can trigger the overflow when a vulnerable rabbitmq-c client calls amqp_login(). An on-path attacker can also trigger it when the client uses plaintext AMQP traffic.
Does exploitation require credentials or user interaction?
No privileges are required, but exploitation requires the client to initiate an AMQP login to a malicious server or for an attacker to interfere with plaintext AMQP traffic. The supplied vector indicates user interaction is required.
What is the impact of a successful exploit?
The immediate effect is heap memory corruption and likely denial of service. Code execution is theoretically possible, but it was not demonstrated.
What versions should be remediated?
rabbitmq-c versions prior to 0.16.0 are affected. Upgrade to version 0.16.0 to obtain the fix.