DEBIAN-CVE-2026-59986: High severity debian/librabbitmq vulnerability
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (offset = o + len) <= encoded.len overflows when o + len > SIZEMAX on 32-bit systems. len is a uint32t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqpbytest with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where sizet is 64-bit. This issue has been patched in version 0.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.11.0-1+deb12u3 - Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.15.0-1+deb13u2 - Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.17.0-1 - Upgrade
Upgrade
rabbitmq-cto a version that resolves this vulnerability.Fixed in 0.17.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects 32-bit systems using librabbitmq, including ARM, MIPS, x86 ILP32, and embedded IoT AMQP clients. It is not exploitable on 64-bit systems where size_t is 64-bit.
What does an attacker need to exploit this?
An attacker needs to supply an AMQP BYTES or UTF8 field with a length value that causes the offset-plus-length calculation to exceed SIZE_MAX on a 32-bit system. The length is read from the AMQP wire, and no authentication or user interaction is required according to the supplied vector.
What is the impact of successful exploitation?
Successful exploitation can cause an out-of-bounds read of up to approximately 4 GB of process memory from a small frame buffer. This can lead to information disclosure or denial of service.
What version fixes the issue?
The issue is patched in rabbitmq-c version 0.17.0.