{"id":"CVE-2026-61547","published":"2026-11-10T17:17:45.650","lastModified":"2026-11-10T17:17:45.650","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-787"],"vendors":[],"products":[],"references":[{"url":"https://github.com/alanxz/rabbitmq-c/pull/892","tags":[]},{"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0","tags":[]},{"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh","tags":[]}],"exploitRefs":[{"url":"https://github.com/alanxz/rabbitmq-c/pull/892","tags":[]},{"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0","tags":[]},{"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh","tags":[]}],"hasPoc":true,"ai":{"summary":"A heap buffer overflow in rabbitmq-c prior to v0.17.0 occurs when amqp_send_frame() processes oversized AMQP_FRAME_BODY payloads due to missing length validation in amqp_frame_to_bytes(), enabling out-of-bounds writes that cause crashes or memory corruption.","exploitability":"Exploitation requires an attacker-controlled application to pass a maliciously oversized body fragment to the public amqp_send_frame() API, which is unlikely unless the application itself is compromised or misconfigured to accept untrusted frame payloads.","blast_radius":"Successful exploitation could lead to remote code execution or denial of service for services using rabbitmq-c, potentially affecting any system relying on this library for RabbitMQ communication.","remediation":"Upgrade to rabbitmq-c version 0.17.0 or later, which contains the patch that validates body fragment size before copying into the outbound buffer.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["heap-overflow","cve-2026-61547","rabbitmq-c","memory-corruption","out-of-bounds-write"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:11.617Z"}}