Integer underflow in RabbitMQ C client - CVE-2026-44235

Vulnerability identifier: #VU147322

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44235

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an integer underflow in AMQP frame length computation in amqp_handle_input() when parsing an undersized AMQP frame. A remote attacker can send a specially crafted undersized AMQP frame to cause a denial of service.

User interaction is required for a victim application to connect to an attacker-controlled AMQP server.

RabbitMQ C client
Debian Linux
openEuler
librabbitmq
librabbitmq-debuginfo
librabbitmq-debugsource
librabbitmq-devel
librabbitmq-help
librabbitmq (Debian package)

Install security update from vendor's website.

RabbitMQ C client - update to 0.16.0
librabbitmq - update to 0.9.0-8
librabbitmq-debuginfo - update to 0.9.0-8
librabbitmq-debugsource - update to 0.9.0-8
librabbitmq-devel - update to 0.9.0-8
librabbitmq-help - update to 0.9.0-8
librabbitmq (Debian package) - update to 0.15.0-1+deb13u1

• https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-9mmv-r8g3-qp46

• Multiple vulnerabilities in RabbitMQ C client
• Debian update for librabbitmq
• openEuler update for librabbitmq