CVE-2026-59986 · Package
NO FIX YET · SEE WHAT TO DO
rabbitmq-c is a C client library for RabbitMQ. On 32-bit systems, a length check in its AMQP field decoder can overflow, letting a malicious broker or peer cause reads of up to about 4 GB of process memory.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that link rabbitmq-c before 0.17.0 and run on 32-bit platforms are exposed, since the overflow does not occur on 64-bit systems. Embedded and IoT AMQP clients are the typical case. Teams on 64-bit hosts, or using a patched version, can skip it.
Not affected if 64-bit-only, version-0.17.0-or-later
Who cares 32-bit, c, embedded, iot, rabbitmq
0.17.0.0.17.0 or later.rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.