CVE-2026-44236

A flaw was found in rabbitmq-c. A malicious AMQP (Advanced Message Queuing Protocol) server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is theoretically possible but has not been demonstrated.

This is a flaw in the rabbitmq-c client library, which can lead to a denial of service. The vulnerability arises from a heap buffer overflow when a client connects to a malicious AMQP server that sends a specially crafted frame_max value during login. Additionally, an on-path attacker can exploit this flaw against plaintext AMQP traffic, making encrypted communication crucial for mitigating this risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that rabbitmq-c clients only connect to trusted AMQP servers. Additionally, enforce the use of TLS/SSL for all AMQP communication to prevent on-path attackers from exploiting this vulnerability against plaintext traffic. Consult your AMQP server and client documentation for specific configuration steps to enable and enforce TLS/SSL.