CVE-2026-44236
Description
A flaw was found in rabbitmq-c. A malicious AMQP (Advanced Message Queuing Protocol) server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is theoretically possible but has not been demonstrated.
Statement
This is a flaw in the rabbitmq-c client library, which can lead to a denial of service. The vulnerability arises from a heap buffer overflow when a client connects to a malicious AMQP server that sends a specially crafted frame_max value during login. Additionally, an on-path attacker can exploit this flaw against plaintext AMQP traffic, making encrypted communication crucial for mitigating this risk.
Mitigation
To mitigate this issue, ensure that `rabbitmq-c` clients only connect to trusted AMQP servers. Additionally, enforce the use of TLS/SSL for all AMQP communication to prevent on-path attackers from exploiting this vulnerability against plaintext traffic. Consult your AMQP server and client documentation for specific configuration steps to enable and enforce TLS/SSL.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 7.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
