CVE-2026-44236 rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max
A malicious AMQP server can trigger a heap buffer overflow in the rabbitmq-c client library during login, causing denial of service or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44236?
CVE-2026-44236 is a high-severity memory corruption vulnerability in alanxz rabbitmq-c, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.
Weakness: CWE-122
Which versions are affected by CVE-2026-44236?
1 open source package ship an affected version, including rabbitmq-c.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq-c Bitnami | All versions | 0.16.0 |
Linux distribution packages (37)
librabbitmq AlmaLinux:10 | All versions | 0.14.0-3.el10_2.1 |
librabbitmq-devel AlmaLinux:10 | All versions | 0.14.0-3.el10_2.1 |
librabbitmq-tools AlmaLinux:10 | All versions | 0.14.0-3.el10_2.1 |
librabbitmq-devel AlmaLinux:8 | All versions | 0.9.0-6.el8_10 |
librabbitmq AlmaLinux:9 | All versions | 0.11.0-7.el9_8.1 |
librabbitmq-devel AlmaLinux:9 | All versions | 0.11.0-7.el9_8.1 |
librabbitmq-tools AlmaLinux:9 | All versions | 0.11.0-7.el9_8.1 |
librabbitmq Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-devel Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-tools Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-tools Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.9.0-6.el8_10 |
librabbitmq Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-devel Red Hat:enterprise_linux:8::crb | All versions | 0:0.9.0-6.el8_10 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:0.9.0-6.el8_10 |
librabbitmq Red Hat:enterprise_linux:9::appstream | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-tools Red Hat:enterprise_linux:9::appstream | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-debugsource Red Hat:enterprise_linux:9::crb | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-devel Red Hat:enterprise_linux:9::crb | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq-tools-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 0:0.11.0-7.el9_8.1 |
librabbitmq Rocky Linux:10 | All versions | 0:0.14.0-3.el10_2.1 |
librabbitmq Rocky Linux:8 | All versions | 0:0.9.0-6.el8_10 |
librabbitmq Rocky Linux:9 | All versions | 0:0.11.0-7.el9_8.1 |
How do I fix CVE-2026-44236?
Upgrade rabbitmq-c to 0.16.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-44236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44236 exists.
Sources
Also known as ALSA-2026:75582, ALSA-2026:82094, ALSA-2026:84795, AZL-105087, BIT-rabbitmq-c-2026-44236, CLSA-2026-1792594240 and 11 more.