{"id":"CVE-2026-61547","kind":"vulnerability","aliases":["CVE-2026-61547"],"related":[],"title":"rabbitmq-c: oversized AMQP body frame causes heap overflow and memory corruption","description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.","summary":"rabbitmq-c, a C client library for RabbitMQ, fails to check body frame size when serializing with amqp_send_frame(), causing a heap out-of-bounds write. An attacker can crash the process and corrupt memory, and the sources do not state code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amqp","c","cpp","package","rabbitmq","rabbitmq-c"],"not_affected_if":["no-raw-body-frames","version-0.17.0-or-later"],"how_to_check":"- Check the installed rabbitmq-c version with `pkg-config --modversion rabbitmq` or your package manager's listing, and see whether it is below `0.17.0`.\n- Search your code for calls to `amqp_send_frame(` that pass AMQP_FRAME_BODY frames built from data you do not control.","fix":"- rabbitmq-c: upgrade to `0.17.0`","status":"open","published_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:23:42+00:00","updated_at":"2026-11-10T17:23:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T17:23:42Z","model":"claude-haiku-5-5","output":{"fix":"- rabbitmq-c: upgrade to `0.17.0`","reach":"unknown","title":"rabbitmq-c: oversized AMQP body frame causes heap overflow and memory corruption","impact":"high","summary":"rabbitmq-c, a C client library for RabbitMQ, fails to check body frame size when serializing with amqp_send_frame(), causing a heap out-of-bounds write. An attacker can crash the process and corrupt memory, and the sources do not state code execution.","audience":"developers","category":"package","nicknames":[],"who_cares":["rabbitmq-c","c","cpp","amqp","rabbitmq"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"process crashes and heap memory is corrupted","analyst_note":"","how_to_check":"- Check the installed rabbitmq-c version with `pkg-config --modversion rabbitmq` or your package manager's listing, and see whether it is below `0.17.0`.\n- Search your code for calls to `amqp_send_frame(` that pass AMQP_FRAME_BODY frames built from data you do not control.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.17.0-or-later","no-raw-body-frames"],"who_is_affected":"Applications written in C or C++ that link rabbitmq-c and call the public amqp_send_frame() API with body frames. The sources describe the trigger as an application passing an oversized body fragment, so applications that only use higher-level publish helpers or never send raw body frames may be less exposed. Services that build body frames from untrusted input are the main concern. The sources do not say whether the bug is reachable from the network without application code doing this.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000785,"input_tokens":4707,"output_tokens":629,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61547':16A,19A '0.17.0':90C,179C 'alloc':141C 'amqp':5A,20B,46B,82C,103C,113C,120C,153C 'api':106C 'applic':145C 'attack':58B 'bodi':6A,40B,115C,136C,150C 'bound':55B,163C 'buffer':93C,131C,143C 'byte':123C,126C 'c':3A,21B,27B,30B,32B,76C,80C,99C 'c-languag':79C 'caus':8A,49B 'check':39B 'client':33B,83C 'code':72B 'connect':129C 'copi':124C 'corrupt':13A,64B,171C 'cpp':22B 'crash':60B,168C 'cve':14A,17A 'execut':73B 'exist':95C 'fail':37B 'fit':138C 'fragment':137C 'frame':7A,41B,48B,105C,114C,121C,142C,151C,155C 'frame.payload.body_fragment.len':125C 'heap':9A,51B,92C,159C 'issu':117C,173C 'languag':81C 'librari':34B,84C 'memori':12A,65B,170C 'occur':118C 'out-of-bound':52B,160C 'outbound':130C 'overflow':10A,94C 'overs':4A,112C,149C 'packag':23B 'pass':147C 'patch':176C 'prior':87C 'process':62B,167C 'public':102C 'rabbitmq':2A,24B,26B,29B,36B,75C,86C,98C 'rabbitmq-c':1A,25B,28B,74C,97C 'result':165C 'send':47B,104C,154C 'serial':44B,110C 'size':42B 'sourc':68B 'state':71B 'trigger':157C 'use':108C 'valid':133C 'version':89C,178C 'within':139C 'without':132C 'write':56B,164C","nicknames":[],"mitigations":[],"who_affected":"Applications written in C or C++ that link rabbitmq-c and call the public amqp_send_frame() API with body frames. The sources describe the trigger as an application passing an oversized body fragment, so applications that only use higher-level publish helpers or never send raw body frames may be less exposed. Services that build body frames from untrusted input are the main concern. The sources do not say whether the bug is reachable from the network without application code doing this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amqp","c","cpp","critical","package","rabbitmq","rabbitmqc"],"campaign_type":null,"search_a":"'-2026':15A,18A '-61547':16A,19A 'amqp':5A 'bodi':6A 'c':3A 'caus':8A 'corrupt':13A 'cve':14A,17A 'frame':7A 'heap':9A 'memori':12A 'overflow':10A 'overs':4A 'rabbitmq':2A 'rabbitmq-c':1A","search_b":"'amqp':20B,46B 'attack':58B 'bodi':40B 'bound':55B 'c':21B,27B,30B,32B 'caus':49B 'check':39B 'client':33B 'code':72B 'corrupt':64B 'cpp':22B 'crash':60B 'execut':73B 'fail':37B 'frame':41B,48B 'heap':51B 'librari':34B 'memori':65B 'out-of-bound':52B 'packag':23B 'process':62B 'rabbitmq':24B,26B,29B,36B 'rabbitmq-c':25B,28B 'send':47B 'serial':44B 'size':42B 'sourc':68B 'state':71B 'write':56B","search_c":"'0.17.0':90C,179C 'alloc':141C 'amqp':82C,103C,113C,120C,153C 'api':106C 'applic':145C 'bodi':115C,136C,150C 'bound':163C 'buffer':93C,131C,143C 'byte':123C,126C 'c':76C,80C,99C 'c-languag':79C 'client':83C 'connect':129C 'copi':124C 'corrupt':171C 'crash':168C 'exist':95C 'fit':138C 'fragment':137C 'frame':105C,114C,121C,142C,151C,155C 'frame.payload.body_fragment.len':125C 'heap':92C,159C 'issu':117C,173C 'languag':81C 'librari':84C 'memori':170C 'occur':118C 'out-of-bound':160C 'outbound':130C 'overflow':94C 'overs':112C,149C 'pass':147C 'patch':176C 'prior':87C 'process':167C 'public':102C 'rabbitmq':75C,86C,98C 'rabbitmq-c':74C,97C 'result':165C 'send':104C,154C 'serial':110C 'trigger':157C 'use':108C 'valid':133C 'version':89C,178C 'within':139C 'without':132C 'write':164C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T04:26:24+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61547","severity":null,"published_at":"2026-11-10T17:17:45+00:00","modified_at":"2026-11-10T17:17:45+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[{"id":116520,"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116523,"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T04:26:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}