Read the docs
TI-2026-32213 Aliases CVE-2026-44236

rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

Priority MEDIUM 64CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix Partial rabbitmq-c (alanxz): 0.16.0Red Hat: 3 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
alanxzrabbitmq-cbefore 0.16.00.16.0Patch availableCNA
  • rabbitmq-c Vendoralanxz Affected before 0.16.0 Fixed in 0.16.0 Patch available CNA

Remediation

  • Fix · CNA rabbitmq-c (alanxz) Fixed in 0.16.0

Red Hat 3 advisories

  • RHSA-2026:84795 Released 2026-10-19 · Red Hat rating Important
    librabbitmq security update
    • Red Hat Enterprise Linux AppStream (v. 10) librabbitmq-0.14.0-3.el10_2.1, librabbitmq-tools-0.14.0-3.el10_2.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) librabbitmq-devel-0.14.0-3.el10_2.1
  • RHSA-2026:82094 Released 2026-10-13 · Red Hat rating Important
    librabbitmq security update
    • Red Hat Enterprise Linux AppStream (v. 9) librabbitmq-0.11.0-7.el9_8.1, librabbitmq-tools-0.11.0-7.el9_8.1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) librabbitmq-devel-0.11.0-7.el9_8.1
  • RHSA-2026:75582 Released 2026-10-05 · Red Hat rating Important
    librabbitmq security update
    • Red Hat Enterprise Linux AppStream (v. 8) librabbitmq-tools-0.9.0-6.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) librabbitmq-0.9.0-6.el8_10
    • Red Hat Enterprise Linux CRB (v. 8) librabbitmq-devel-0.9.0-6.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:84795
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:75582
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:82094
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:75582
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:75582
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:84795
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:82094

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44236
  2. 2026-10-05 Fix available: RHSA-2026:75582 · Red Hat
  3. 2026-10-05 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · Red Hat
  4. 2026-10-13 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82094 · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84795 · Red Hat
  7. 2026-10-20 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat

References

Other 4

  • TI-2026-32212 rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences