Integer overflow in RabbitMQ C client - CVE-2026-59986

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an integer overflow in the amqp_decode_bytes function when parsing AMQP BYTES or UTF8 field lengths. A remote attacker can send a crafted AMQP frame containing an oversized field length to disclose sensitive information or cause a denial of service.

Only 32-bit systems are affected; exploitation may require a malicious AMQP broker or a man-in-the-middle position on an unencrypted connection.

Affected software

How to mitigate CVE-2026-59986

External References

• https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7

Related Security Bulletins

• Multiple vulnerabilities in RabbitMQ C client
• Debian update for librabbitmq
• openEuler update for librabbitmq