Executive brief
rabbitmq-c is a C library used by applications to communicate with RabbitMQ message brokers. A malicious or compromised RabbitMQ server can send a specially crafted network message that causes the client library to write data beyond an allocated memory buffer, resulting in a crash or potential code execution. This vulnerability affects any application using rabbitmq-c prior to version 0.16.0.
Technical details
The vulnerability is a heap buffer overflow in the AMQP connection negotiation phase. During amqp_login(), a malicious AMQP server sends an undersized connection.tune.frame_max value. The vulnerable code in amqp_tune_connection() (librabbitmq/amqp_connection.c) uses this untrusted frame_max to reallocate the outbound buffer without validating it against AMQP_FRAME_MIN_SIZE. When amqp_frame_to_bytes() attempts to serialize the connection.tune-ok frame, it writes beyond the undersized heap allocation. An on-path attacker can exploit this against plaintext AMQP connections without needing server compromise. The flaw causes memory corruption leading to denial of service; code execution is theoretically possible but was not demonstrated. The issue is fixed in rabbitmq-c 0.16.0 by enforcing minimum frame_max validation.
Affected products
- rabbitmq-c rabbitmq-c prior to 0.16.0
Timeline
- 2026-09-17: disclosed
- 2026-06-09: patched: Version 0.16.0 released with fix