rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8724-1 advisory.

    It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line,     making them visible to other local users through the process list. An attacker could possibly use this to     obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t     underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial     of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

    It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login     handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a     denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

    It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading     to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or     able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read,     resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

    It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body     frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow,     resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This     issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4658 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4658-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 30, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : librabbitmq     Version        : 0.10.0-1+deb11u2 0.11.0-1+deb12u2     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two issues were discovered in librabbitmq, a C-language client     library used to communicate with RabbitMQ servers using the Advanced     Message Queuing Protocol (AMQP).

    CVE-2026-44235

        A size_t underflow in AMQP frame length computation could have         led to an out-of-bounds read.

    CVE-2026-44236

        A heap buffer overflow in AMQP login handshake via undersized         connection.tune.frame_max.

    For Debian 11 bullseye, these problems have been fixed in version     0.10.0-1+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version     0.11.0-1+deb12u2.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8437-1 advisory.

    It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain     circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances,     which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235)

    It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances,     which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6343 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6343-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 12, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : librabbitmq     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two security vulnberabilities were discovered in librabbitmq, an AMQP     client library, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 0.15.0-1+deb13u1.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
344621	Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)	Nessus	Ubuntu Local Security Checks	Local	medium
323988	Debian dla-4658 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high
321367	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rabbitmq-c vulnerabilities (USN-8437-1)	Nessus	Ubuntu Local Security Checks	Local	medium
320890	Debian dsa-6343 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-44235

medium

Tenable Plugins

medium

high

medium

high