CVE-2026-61547: rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY

Q: Which applications are exposed to this issue?

Applications using rabbitmq-c before version 0.17.0 are affected if they call the public amqp_send_frame() API with an oversized AMQP_FRAME_BODY. The vulnerable component is the client library, so exposure depends on how the application constructs and sends frames.

Q: What is required to trigger the overflow?

An application must pass an AMQP_FRAME_BODY whose body fragment is larger than the allocated outbound frame buffer to amqp_send_frame(). The vulnerable serialization path does not validate that frame.payload.body_fragment.len fits in that buffer.

Q: What happens if the flaw is triggered?

The oversized body fragment is copied beyond the heap-allocated outbound buffer, causing an out-of-bounds write. This can crash the process and corrupt memory.

Q: What version fixes the issue?

The issue is patched in rabbitmq-c version 0.17.0. Upgrading to that version removes the described missing bounds validation in this path.

Published Nov 10, 2026

Updated

Last updated 4 September 2026

Other sources

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqpsendframe() API is used to serialize an oversized AMQPFRAMEBODY. The issue occurs because amqpframetobytes() copies frame.payload.bodyfragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqpsendframe() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.

— MITRE

Affected Software

1 affected componentFixes available

debian/librabbitmq<=0.11.0-1+deb12u2, <=0.15.0-1+deb13u1

0.11.0-1+deb12u30.15.0-1+deb13u20.17.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/librabbitmq to a version that resolves this vulnerability.
Fixed in 0.11.0-1+deb12u3Fixed in 0.15.0-1+deb13u2Fixed in 0.17.0-1
Upgrade
Upgrade rabbitmq-c to a version that resolves this vulnerability.
Fixed in 0.17.0

Event History

Nov 10, 2026

CVE Published

via MITRE·04:21 PM

Data Sourced

via MITRE·04:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using rabbitmq-c before version 0.17.0 are affected if they call the public amqp_send_frame() API with an oversized AMQP_FRAME_BODY. The vulnerable component is the client library, so exposure depends on how the application constructs and sends frames.

What is required to trigger the overflow?

An application must pass an AMQP_FRAME_BODY whose body fragment is larger than the allocated outbound frame buffer to amqp_send_frame(). The vulnerable serialization path does not validate that frame.payload.body_fragment.len fits in that buffer.

What happens if the flaw is triggered?

The oversized body fragment is copied beyond the heap-allocated outbound buffer, causing an out-of-bounds write. This can crash the process and corrupt memory.

What version fixes the issue?

The issue is patched in rabbitmq-c version 0.17.0. Upgrading to that version removes the described missing bounds validation in this path.

CVE-2026-61547: rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What is required to trigger the overflow?

What happens if the flaw is triggered?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What is required to trigger the overflow?

What happens if the flaw is triggered?

What version fixes the issue?