{"id":"CVE-2026-59986","kind":"vulnerability","aliases":["CVE-2026-59986"],"related":[],"title":"rabbitmq-c: integer overflow in AMQP decoder leaks memory on 32-bit systems","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.","summary":"rabbitmq-c is a C client library for RabbitMQ. On 32-bit systems, a length check in its AMQP field decoder can overflow, letting a malicious broker or peer cause reads of up to about 4 GB of process memory.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["32-bit","c","embedded","iot","package","rabbitmq"],"not_affected_if":["64-bit-only","version-0.17.0-or-later"],"how_to_check":"- Check the installed version of rabbitmq-c and confirm whether it is below `0.17.0`.\n- Confirm whether the application runs on a 32-bit target (ARM, MIPS, x86 ILP32, embedded IoT).\n- Check whether the application decodes AMQP messages from untrusted or unverified brokers.","fix":"- rabbitmq-c: move to `0.17.0` or later.","status":"open","published_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:23:58+00:00","updated_at":"2026-11-10T17:23:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T17:23:58Z","model":"claude-haiku-5-5","output":{"fix":"- rabbitmq-c: move to `0.17.0` or later.","reach":"network","title":"rabbitmq-c: integer overflow in AMQP decoder leaks memory on 32-bit systems","impact":"medium","summary":"rabbitmq-c is a C client library for RabbitMQ. On 32-bit systems, a length check in its AMQP field decoder can overflow, letting a malicious broker or peer cause reads of up to about 4 GB of process memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["rabbitmq","c","embedded","iot","32-bit"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Out-of-bounds memory read; information disclosure or denial of service","analyst_note":"","how_to_check":"- Check the installed version of rabbitmq-c and confirm whether it is below `0.17.0`.\n- Confirm whether the application runs on a 32-bit target (ARM, MIPS, x86 ILP32, embedded IoT).\n- Check whether the application decodes AMQP messages from untrusted or unverified brokers.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["64-bit-only","version-0.17.0-or-later"],"who_is_affected":"Applications that link rabbitmq-c before 0.17.0 and run on 32-bit platforms are exposed, since the overflow does not occur on 64-bit systems. Embedded and IoT AMQP clients are the typical case. Teams on 64-bit hosts, or using a patched version, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4761,"output_tokens":586,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-59986':17A,20A '0.17.0':85C,201C '32':12A,21B,39B,100C,164C '4':64B '4gb':159C '64':185C,192C 'amqp':7A,47B,77C,111C,132C,173C 'arm':167C 'bit':13A,22B,40B,101C,165C,186C,193C 'bound':87C,154C 'broker':55B 'buffer':146C 'byte':133C 'bytes/utf8':115C 'c':3A,23B,30B,33B,71C,75C 'c-languag':74C 'caus':58B 'check':44B,88C,122C 'client':34B,78C,174C 'cve':15A,18A 'decod':8A,49B,131C 'denial':179C 'disclosur':177C 'embed':24B,171C 'enabl':175C 'encoded.len':92C 'exploit':183C 'field':48B,116C 'frame':145C 'gb':65B,139C 'ilp32':170C 'inform':176C 'integ':4A 'iot':25B,172C 'issu':195C 'languag':76C 'leak':9A 'len':91C,96C,103C,140C 'length':43B,117C 'let':52B 'librari':35B,79C 'malici':54B 'max':98C 'memori':10A,68B,162C 'mip':168C 'multi':138C 'multi-gb':137C 'o':90C,95C 'offset':89C 'out-of-bound':151C 'overflow':5A,51B,93C,119C 'packag':26B 'pass':128C 'patch':198C 'peer':57B 'point':141C 'prior':82C 'process':67B,161C 'produc':129C 'rabbitmq':2A,27B,29B,37B,70C,81C 'rabbitmq-c':1A,28B,69C 'read':59B,108C,155C 'result':148C 'servic':181C 'size':97C,189C 'small':125C,144C 'system':14A,41B,102C,166C,187C 'uint32':106C 'valu':126C 'version':84C,200C 'wire':112C 'wrap':120C 'x86':169C","nicknames":[],"mitigations":[],"who_affected":"Applications that link rabbitmq-c before 0.17.0 and run on 32-bit platforms are exposed, since the overflow does not occur on 64-bit systems. Embedded and IoT AMQP clients are the typical case. Teams on 64-bit hosts, or using a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["32bit","c","embedded","high","iot","package","rabbitmq"],"campaign_type":null,"search_a":"'-2026':16A,19A '-59986':17A,20A '32':12A 'amqp':7A 'bit':13A 'c':3A 'cve':15A,18A 'decod':8A 'integ':4A 'leak':9A 'memori':10A 'overflow':5A 'rabbitmq':2A 'rabbitmq-c':1A 'system':14A","search_b":"'32':21B,39B '4':64B 'amqp':47B 'bit':22B,40B 'broker':55B 'c':23B,30B,33B 'caus':58B 'check':44B 'client':34B 'decod':49B 'embed':24B 'field':48B 'gb':65B 'iot':25B 'length':43B 'let':52B 'librari':35B 'malici':54B 'memori':68B 'overflow':51B 'packag':26B 'peer':57B 'process':67B 'rabbitmq':27B,29B,37B 'rabbitmq-c':28B 'read':59B 'system':41B","search_c":"'0.17.0':85C,201C '32':100C,164C '4gb':159C '64':185C,192C 'amqp':77C,111C,132C,173C 'arm':167C 'bit':101C,165C,186C,193C 'bound':87C,154C 'buffer':146C 'byte':133C 'bytes/utf8':115C 'c':71C,75C 'c-languag':74C 'check':88C,122C 'client':78C,174C 'decod':131C 'denial':179C 'disclosur':177C 'embed':171C 'enabl':175C 'encoded.len':92C 'exploit':183C 'field':116C 'frame':145C 'gb':139C 'ilp32':170C 'inform':176C 'iot':172C 'issu':195C 'languag':76C 'len':91C,96C,103C,140C 'length':117C 'librari':79C 'max':98C 'memori':162C 'mip':168C 'multi':138C 'multi-gb':137C 'o':90C,95C 'offset':89C 'out-of-bound':151C 'overflow':93C,119C 'pass':128C 'patch':198C 'point':141C 'prior':82C 'process':161C 'produc':129C 'rabbitmq':70C,81C 'rabbitmq-c':69C 'read':108C,155C 'result':148C 'servic':181C 'size':97C,189C 'small':125C,144C 'system':102C,166C,187C 'uint32':106C 'valu':126C 'version':84C,200C 'wire':112C 'wrap':120C 'x86':169C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T04:27:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59986","severity":null,"published_at":"2026-11-10T17:17:45+00:00","modified_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[{"id":116520,"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116521,"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T04:27:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}