Ubuntu Linux - size_t underflow in AMQP frame length computation leads to out-of-bounds read in rabbitmq-c

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4658 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4658-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 30, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : librabbitmq     Version        : 0.10.0-1+deb11u2 0.11.0-1+deb12u2     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two issues were discovered in librabbitmq, a C-language client     library used to communicate with RabbitMQ servers using the Advanced     Message Queuing Protocol (AMQP).

    CVE-2026-44235

        A size_t underflow in AMQP frame length computation could have         led to an out-of-bounds read.

    CVE-2026-44236

        A heap buffer overflow in AMQP login handshake via undersized         connection.tune.frame_max.

    For Debian 11 bullseye, these problems have been fixed in version     0.10.0-1+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version     0.11.0-1+deb12u2.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8437-1 advisory.

    It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain     circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances,     which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235)

    It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances,     which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6343 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6343-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 12, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : librabbitmq     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two security vulnberabilities were discovered in librabbitmq, an AMQP     client library, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 0.15.0-1+deb13u1.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - librabbitmq - None  Ubuntu Linux - size_t underflow in AMQP frame length computation leads     to out-of-bounds read in rabbitmq-c (CVE-2026-44235)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323988	Debian dla-4658 : amqp-tools - security update	Nessus	Debian Local Security Checks	critical
321367	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rabbitmq-c vulnerabilities (USN-8437-1)	Nessus	Ubuntu Local Security Checks	medium
320890	Debian dsa-6343 : amqp-tools - security update	Nessus	Debian Local Security Checks	critical
320344	Linux Distros Unpatched Vulnerability : CVE-2026-44235	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-44235

critical

Tenable Plugins

critical

medium

critical

critical