CVE-2026-44235 in rabbitmq-c
Summary
by MITRE • 09/17/2026
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The rabbitmq-c library serves as a C-language implementation of an Advanced Message Queuing Protocol client for interacting with RabbitMQ message brokers. A critical vulnerability exists within the connection handling logic, specifically in the amqp_handle_input function located in librabbitmq/amqp_connection.c. This flaw manifests when processing AMQP frames during the initial login phase or subsequent communication if TLS is not properly enforced. The core technical deficiency lies in the absence of a minimum frame length validation before performing arithmetic operations on frame size fields. Specifically, the parser calculates the expected payload size by subtracting HEADER_SIZE, fixed per-frame field sizes, and FOOTER_SIZE from state->target_size without verifying that target_size is large enough to accommodate these deductions.
This lack of boundary checking leads directly to an unsigned integer underflow when a malicious AMQP server sends an undersized HEADER or METHOD frame. Because the size variable is treated as an unsigned type, subtracting values larger than the current total results in a wrap-around effect, producing an excessively large encoded length value. This corrupted length is subsequently passed through amqp_decode_properties() and into amqp_decode_table_internal(). The downstream parsing functions rely on this inflated length to determine memory access boundaries, effectively defeating their internal bounds checks. Consequently, the application attempts to read data from memory locations beyond the allocated buffer, resulting in an out-of-bounds read operation that typically causes a process crash due to segmentation faults or invalid memory access violations.
The operational impact of this vulnerability is primarily denial of service against RabbitMQ clients utilizing rabbitmq-c. An attacker positioned on the network path can exploit this flaw by crafting malicious AMQP frames with deliberately undersized headers during authentication or early session establishment. If the connection lacks Transport Layer Security protection, particularly without strict certificate validation that would prevent connections to rogue servers, the client is vulnerable to remote exploitation. While the immediate and demonstrated consequence is a crash of the client application, preventing further message processing, there are no reliable indications in current analyses of memory disclosure or arbitrary code execution stemming from this specific underflow path. However, out-of-bounds reads inherently carry risks of information leakage depending on the surrounding memory state at runtime.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Read within the Common Weakness Enumeration framework. In terms of adversary tactics, it relates to ATT&CK technique T1499 Endpoint Denial of Service, as the primary objective achievable through exploitation is disrupting service availability rather than gaining persistent access or data exfiltration. Mitigation strategies focus on upgrading to version 0.16.0 or later where the arithmetic operations are protected by proper length checks before subtraction occurs. Additionally, organizations should enforce TLS encryption for all AMQP traffic and implement strict certificate validation policies to prevent clients from connecting to untrusted or malicious servers that might attempt such frame manipulation attacks.