CVE-2026-61547 rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY
CriticalCVSS 9.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alanxz rabbitmq-c | = < 0.17.0 | No fix listed |
| debian/librabbitmq(Debian:12) | < 0.11.0-1+deb12u3 | 0.11.0-1+deb12u3 |
| debian/librabbitmq(Debian:12) | = 0.11.0-1 | No fix listed |
| debian/librabbitmq(Debian:12) | = 0.11.0-1+deb12u1 | No fix listed |
| debian/librabbitmq(Debian:12) | = 0.11.0-1+deb12u2 | No fix listed |
| debian/librabbitmq(Debian:13) | < 0.15.0-1+deb13u2 | 0.15.0-1+deb13u2 |
| debian/librabbitmq(Debian:13) | = 0.15.0-1 | No fix listed |
| debian/librabbitmq(Debian:13) | = 0.15.0-1+deb13u1 | No fix listed |
| debian/librabbitmq(Debian:14) | < 0.17.0-1 | 0.17.0-1 |
| debian/librabbitmq(Debian:14) | = 0.15.0-1 | No fix listed |
| debian/librabbitmq(Debian:14) | = 0.16.0-1 | No fix listed |
| ubuntu/librabbitmq(Ubuntu:22.04) | < 0.10.0-1ubuntu2.2 | 0.10.0-1ubuntu2.2 |
| ubuntu/librabbitmq(Ubuntu:24.04) | < 0.11.0-1ubuntu0.2 | 0.11.0-1ubuntu0.2 |
| ubuntu/librabbitmq(Ubuntu:26.04) | < 0.15.0-1ubuntu0.26.04.2 | 0.15.0-1ubuntu0.26.04.2 |
References
- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh
- https://github.com/alanxz/rabbitmq-c/pull/892
- https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0
- Debian Security Tracker CVE-2026-61547 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8724-1 vendor-advisory
- www.cve.org