DEBIAN-CVE-2026-61547: Buffer Overflow
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqpsendframe() API is used to serialize an oversized AMQPFRAMEBODY. The issue occurs because amqpframetobytes() copies frame.payload.bodyfragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqpsendframe() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.11.0-1+deb12u3 - Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.15.0-1+deb13u2 - Upgrade
Upgrade
debian/librabbitmqto a version that resolves this vulnerability.Fixed in 0.17.0-1 - Upgrade
Upgrade
rabbitmq-cto a version that resolves this vulnerability.Fixed in 0.17.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Debian's librabbitmq and directly calling the public amqp_send_frame() API with AMQP_FRAME_BODY frames are exposed if they can pass an oversized body fragment. The vulnerable behavior is in serialization of that caller-supplied frame.
Does an attacker need credentials or user interaction to exploit this?
The reported severity vector indicates network exploitation with low attack complexity, no privileges, and no user interaction. Exploitation still depends on an application passing an oversized AMQP_FRAME_BODY to amqp_send_frame().
What is the impact of a successful exploit?
An oversized body frame can cause a heap out-of-bounds write, leading to process crashes and memory corruption. The severity information rates confidentiality, integrity, and availability impact as high.
What should teams do to remediate the issue?
Upgrade rabbitmq-c to version 0.17.0 or later, where the issue is patched. If upgrading is not immediately possible, avoid passing oversized AMQP_FRAME_BODY payloads through amqp_send_frame().