Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-44236— rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

Quick assessment

Affected
alanxz rabbitmq-c
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rabbitmq-c 是一个用于 RabbitMQ 的 C 语言 AMQP 客户端库。在 0.16.0 版本之前，一个恶意的 AMQP 服务器可以在 过程中发送一个尺寸过小的 值，而 rabbitmq-c 会在 的 中接受该值。 中的 函数使用 重新分配出站缓冲区，但没有强制校验 。随后通过 对 帧进行序列化时，会写入超出该缩小后的堆内存分配范围，从而导致内存损坏，并很可能引发服务拒绝（DoS）。路径上的攻击者（on-path attacker）还可以针对明文 AMQP 流量触发此缺陷。理论上可能发生代码执行，但尚

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
alanxz rabbitmq-c < 0.16.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44236

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max
Source: CVE Program / CVE List V5
Vulnerability Description
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN_SIZE. Immediate serialization of connection.tune-ok through amqp_frame_to_bytes() writes beyond the undersized heap allocation, causing memory corruption and likely denial of service. An on-path attacker can also trigger the flaw against plaintext AMQP traffic. Code execution is theoretically possible but was not demonstrated. This issue is fixed in version 0.16.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
alanxz rabbitmq-c < 0.16.0 -

II. Public POCs for CVE-2026-44236

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44236

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-44236 (2)

Vendor Advisories for CVE-2026-44236 (1)

Vendor Pages for CVE-2026-44236 (1)

IV. Related Vulnerabilities

Same product: rabbitmq-c
Same vendor: alanxz
Same weakness: CWE-122

V. Comments for CVE-2026-44236

No comments yet

Leave a comment