Debian Linux - librabbitmq - None

Ubuntu Linux - Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8437-1 advisory.

    It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain     circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789)

    It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances,     which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235)

    It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances,     which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause     rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6343 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6343-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 12, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : librabbitmq     CVE ID         : CVE-2026-44235 CVE-2026-44236

    Two security vulnberabilities were discovered in librabbitmq, an AMQP     client library, which could result in denial of service or potentially     the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 0.15.0-1+deb13u1.

    We recommend that you upgrade your librabbitmq packages.

    For the detailed security status of librabbitmq please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/librabbitmq

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - librabbitmq - None  Ubuntu Linux - Heap buffer overflow in AMQP login handshake via     undersized connection.tune.frame_max (CVE-2026-44236)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321367	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rabbitmq-c vulnerabilities (USN-8437-1)	Nessus	Ubuntu Local Security Checks	medium
320890	Debian dsa-6343 : amqp-tools - security update	Nessus	Debian Local Security Checks	critical
320345	Linux Distros Unpatched Vulnerability : CVE-2026-44236	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-44236

critical

Tenable Plugins

medium

critical

critical