UBUNTU-CVE-2026-44235

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-44235
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-44235
Upstream
Downstream
USN (2)
Related
USN (2)
Published
2026-06-11T00:00:00Z
Modified
2026-09-24T02:00:18Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size_t underflow in amqp_handle_input() in librabbitmq/amqp_connection.c. The parser subtracts HEADER_SIZE, fixed per-frame fields, and FOOTER_SIZE from state->target_size without first checking the minimum frame length. The wrapped encoded.len value is passed through amqp_decode_properties() to amqp_decode_table_internal(), where it defeats bounds checks and causes an out-of-bounds read and process crash. An on-path attacker can also trigger the issue when AMQP traffic is not protected by TLS with certificate validation. The demonstrated impact is denial of service, with no reliable memory disclosure or code execution shown. This issue is fixed in version 0.16.0.

References

Affected packages

Ubuntu:22.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.10.0-1ubuntu2.1

Affected versions

0.*
0.10.0-1
0.10.0-1build1
0.10.0-1ubuntu1
0.10.0-1ubuntu2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.10.0-1ubuntu2.1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.10.0-1ubuntu2.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:24.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.11.0-1ubuntu0.1

Affected versions

0.*
0.11.0-1
0.11.0-1build1
0.11.0-1build2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.11.0-1ubuntu0.1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.11.0-1ubuntu0.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:25.10
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.0-1ubuntu0.25.10.1

Affected versions

0.*
0.15.0-1
0.15.0-1build1

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.15.0-1ubuntu0.25.10.1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.15.0-1ubuntu0.25.10.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:26.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.15.0-1ubuntu0.26.04.1

Affected versions

0.*
0.15.0-1build1
0.15.0-1build2

Ecosystem specific 

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.15.0-1ubuntu0.26.04.1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.15.0-1ubuntu0.26.04.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:Pro:14.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.4.1-1ubuntu0.1~esm2

Affected versions

0.*
0.3.0-1
0.4.1-1
0.4.1-1ubuntu0.1~esm1

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.4.1-1ubuntu0.1~esm2"
        },
        {
            "binary_name":  "librabbitmq1",
            "binary_version":  "0.4.1-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:Pro:16.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.1-1ubuntu0.2+esm1

Affected versions

0.*
0.5.2-2
0.7.1-1
0.7.1-1ubuntu0.1
0.7.1-1ubuntu0.2

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.7.1-1ubuntu0.2+esm1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.7.1-1ubuntu0.2+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:Pro:18.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.0-1ubuntu0.18.04.2+esm1

Affected versions

0.*
0.8.0-1
0.8.0-1build1
0.8.0-1ubuntu0.18.04.1
0.8.0-1ubuntu0.18.04.2

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.8.0-1ubuntu0.18.04.2+esm1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.8.0-1ubuntu0.18.04.2+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"
Ubuntu:Pro:20.04:LTS
librabbitmq

Package

Name
librabbitmq
Purl
pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.10.0-1ubuntu0.20.04.1~esm1

Affected versions

0.*
0.9.0-0.2
0.9.0-0.2ubuntu1
0.10.0-1

Ecosystem specific 

{
    "availability":  "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries":  [
        {
            "binary_name":  "amqp-tools",
            "binary_version":  "0.10.0-1ubuntu0.20.04.1~esm1"
        },
        {
            "binary_name":  "librabbitmq4",
            "binary_version":  "0.10.0-1ubuntu0.20.04.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-44235.json"