rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 03308f12-c15d-11f1-ab87-107c611e671e advisory.

    The rabbitmq-c project reports:
    CVE-2026-44236: A malicious AMQP server can send an               undersized connection.tune.frame_max value during the login               handshake. The library does not enforce the protocol minimum               frame size, reallocates its outbound buffer to an invalid size               and then writes frame data beyond it, causing a heap buffer               overflow before authentication completes.
    CVE-2026-44235: An unsigned integer underflow in the frame               length computation when parsing undersized AMQP frames               bypasses bounds checks in the property and table decoders,               leading to an out-of-bounds read and client-side denial of               service.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can
    send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in
    amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame
    fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The
    wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(),
    where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can
    also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The
    demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This
    issue is fixed in version 0.16.0. (CVE-2026-44235)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8724-1 advisory.

    It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line,     making them visible to other local users through the process list. An attacker could possibly use this to     obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t     underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial     of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

    It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login     handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a     denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

    It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading     to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or     able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read,     resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

    It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body     frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow,     resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This     issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4658 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4658-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 30, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : librabbitmq     Version        : 0.10.0-1+deb11u2 0.11.0-1+deb12u2     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two issues were discovered in librabbitmq, a C-language client     library used to communicate with RabbitMQ servers using the Advanced     Message Queuing Protocol (AMQP).

    CVE-2026-44235

        A size_t underflow in AMQP frame length computation could have         led to an out-of-bounds read.

    CVE-2026-44236

        A heap buffer overflow in AMQP login handshake via undersized         connection.tune.frame_max.

    For Debian 11 bullseye, these problems have been fixed in version     0.10.0-1+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version     0.11.0-1+deb12u2.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8437-1 advisory.

    It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain     circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances,     which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235)

    It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances,     which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6343 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6343-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 12, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : librabbitmq     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two security vulnberabilities were discovered in librabbitmq, an AMQP     client library, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 0.15.0-1+deb13u1.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can     send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in     amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame     fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The     wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(),     where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can     also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The     demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This     issue is fixed in version 0.16.0. (CVE-2026-44235)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363458	FreeBSD : rabbitmq-c -- multiple vulnerabilities (03308f12-c15d-11f1-ab87-107c611e671e)	Nessus	FreeBSD Local Security Checks	Local	high
455188	Echo: librabbitmq: security update to 0.15.0-1+deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455188	Echo: librabbitmq: security update to 0.15.0-1+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
344621	Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)	Nessus	Ubuntu Local Security Checks	Local	medium
323988	Debian dla-4658 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high
321367	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rabbitmq-c vulnerabilities (USN-8437-1)	Nessus	Ubuntu Local Security Checks	Local	medium
320890	Debian dsa-6343 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high
320344	Linux Distros Unpatched Vulnerability : CVE-2026-44235	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-44235

medium

Tenable Plugins

high

medium

medium

medium

high

medium

high

medium