rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_75582 advisory.

    * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1981:01 advisory.

    * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-75582 advisory.

    - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z]       leading to denial of service [rhel-8.10.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 03308f12-c15d-11f1-ab87-107c611e671e advisory.

    The rabbitmq-c project reports:
    CVE-2026-44236: A malicious AMQP server can send an               undersized connection.tune.frame_max value during the login               handshake. The library does not enforce the protocol minimum               frame size, reallocates its outbound buffer to an invalid size               and then writes frame data beyond it, causing a heap buffer               overflow before authentication completes.
    CVE-2026-44235: An unsigned integer underflow in the frame               length computation when parsing undersized AMQP frames               bypasses bounds checks in the property and table decoders,               leading to an out-of-bounds read and client-side denial of               service.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:75582 advisory.

    * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75582 advisory.

    * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:75582 advisory.

    The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows     you to communicate with AMQP servers using protocol version 0-9-1.

    Security Fix(es):

    * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can
    send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value
    in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in
    librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing
    AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes
    beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path
    attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically
    possible but was not demonstrated. This issue is fixed in version 0.16.0. (CVE-2026-44236)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8724-1 advisory.

    It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line,     making them visible to other local users through the process list. An attacker could possibly use this to     obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t     underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial     of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

    It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login     handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a     denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

    It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading     to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or     able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read,     resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

    It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body     frame with the amqp_send_frame() API. An attacker could possibly use this to cause a heap buffer overflow,     resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This     issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4658 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4658-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     June 30, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : librabbitmq     Version        : 0.10.0-1+deb11u2 0.11.0-1+deb12u2     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two issues were discovered in librabbitmq, a C-language client     library used to communicate with RabbitMQ servers using the Advanced     Message Queuing Protocol (AMQP).

    CVE-2026-44235

        A size_t underflow in AMQP frame length computation could have         led to an out-of-bounds read.

    CVE-2026-44236

        A heap buffer overflow in AMQP login handshake via undersized         connection.tune.frame_max.

    For Debian 11 bullseye, these problems have been fixed in version     0.10.0-1+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version     0.11.0-1+deb12u2.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8437-1 advisory.

    It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain     circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances,     which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235)

    It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances,     which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6343 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6343-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 12, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : librabbitmq     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two security vulnberabilities were discovered in librabbitmq, an AMQP     client library, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 0.15.0-1+deb13u1.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can     send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value     in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in     librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing     AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes     beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path     attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically     possible but was not demonstrated. This issue is fixed in version 0.16.0. (CVE-2026-44236)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
363854	Rocky Linux 8 [CIQ] Security Update: librabbitmq / librabbitmq-debuginfo / librabbitmq-debugsource / etc (crlsa-2026_75582)	Nessus	Rocky Linux Local Security Checks	Local	high
363760	MiracleLinux 8 : librabbitmq-0.9.0-6.el8_10 (AXSA:2026-1981:01)	Nessus	Miracle Linux Local Security Checks	Local	high
363465	Oracle Linux 8 : librabbitmq (ELSA-2026-75582)	Nessus	Oracle Linux Local Security Checks	Local	high
363458	FreeBSD : rabbitmq-c -- multiple vulnerabilities (03308f12-c15d-11f1-ab87-107c611e671e)	Nessus	FreeBSD Local Security Checks	Local	high
363156	AlmaLinux 8 : librabbitmq (ALSA-2026:75582)	Nessus	Alma Linux Local Security Checks	Local	high
363104	RockyLinux 8 : librabbitmq (RLSA-2026:75582)	Nessus	Rocky Linux Local Security Checks	Local	high
362917	RHEL 8 : librabbitmq (RHSA-2026:75582)	Nessus	Red Hat Local Security Checks	Local	high
464102	Echo: librabbitmq: security update to 0.15.0-1+deb13u1	Tenable Cloud Security	Echo Local Security Checks	Local	high
464102	Echo: librabbitmq: security update to 0.15.0-1+deb13u1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
344621	Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : rabbitmq-c vulnerabilities (USN-8724-1)	Nessus	Ubuntu Local Security Checks	Local	medium
323988	Debian dla-4658 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high
321367	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rabbitmq-c vulnerabilities (USN-8437-1)	Nessus	Ubuntu Local Security Checks	Local	medium
320890	Debian dsa-6343 : amqp-tools - security update	Nessus	Debian Local Security Checks	Local	high
320345	Linux Distros Unpatched Vulnerability : CVE-2026-44236	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-44236

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium

high

medium

high

high