USN-8724-1

It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)

It was discovered that rabbitmq-c did not correctly compute AMQP frame lengths, leading to a size_t underflow. A remote attacker could possibly use this to cause rabbitmq-c to crash, resulting in a denial of service, or possibly expose sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44235)

It was discovered that rabbitmq-c did not properly validate the frame size during the AMQP login handshake. A remote attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service or possibly the execution of arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44236)

It was discovered that rabbitmq-c did not correctly validate the length of decoded bytes fields, leading to an integer overflow in a bounds check on 32-bit systems. A remote attacker controlling a broker, or able to intercept an unencrypted connection, could possibly use this to cause an out-of-bounds read, resulting in a denial of service or the exposure of sensitive information. (CVE-2026-59986)

It was discovered that rabbitmq-c did not validate the body fragment length when serialising an AMQP body frame with the amqpsendframe() API. An attacker could possibly use this to cause a heap buffer overflow, resulting in a denial of service (application crash) or possibly the execution of arbitrary code. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61547)

References

Affected packages

Ubuntu:22.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.0-1ubuntu2.2

Affected versions

0.*

0.10.0-1

0.10.0-1build1

0.10.0-1ubuntu1

0.10.0-1ubuntu2

0.10.0-1ubuntu2.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "0.10.0-1ubuntu2.2",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.10.0-1ubuntu2.2",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:22.04:LTS",
    "cves": [
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:24.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.0-1ubuntu0.2

Affected versions

0.*

0.11.0-1

0.11.0-1build1

0.11.0-1build2

0.11.0-1ubuntu0.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "0.11.0-1ubuntu0.2",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.11.0-1ubuntu0.2",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:24.04:LTS",
    "cves": [
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:26.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.15.0-1ubuntu0.26.04.2

Affected versions

0.*

0.15.0-1build1

0.15.0-1build2

0.15.0-1ubuntu0.26.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "0.15.0-1ubuntu0.26.04.2",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.15.0-1ubuntu0.26.04.2",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:26.04:LTS",
    "cves": [
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:Pro:14.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.1-1ubuntu0.1~esm2

Affected versions

0.*

0.3.0-1

0.4.1-1

0.4.1-1ubuntu0.1~esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "0.4.1-1ubuntu0.1~esm2",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.4.1-1ubuntu0.1~esm2",
            "binary_name": "librabbitmq1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:Pro:14.04:LTS",
    "cves": [
        {
            "id": "CVE-2023-35789",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2026-44235",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-44236",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:Pro:16.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.1-1ubuntu0.2+esm1

Affected versions

0.*

0.5.2-2

0.7.1-1

0.7.1-1ubuntu0.1

0.7.1-1ubuntu0.2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "0.7.1-1ubuntu0.2+esm1",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.7.1-1ubuntu0.2+esm1",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:Pro:16.04:LTS",
    "cves": [
        {
            "id": "CVE-2023-35789",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2026-44235",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-44236",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:Pro:18.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.8.0-1ubuntu0.18.04.2+esm1

Affected versions

0.*

0.8.0-1

0.8.0-1build1

0.8.0-1ubuntu0.18.04.1

0.8.0-1ubuntu0.18.04.2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "0.8.0-1ubuntu0.18.04.2+esm1",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.8.0-1ubuntu0.18.04.2+esm1",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:Pro:18.04:LTS",
    "cves": [
        {
            "id": "CVE-2023-35789",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2026-44235",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-44236",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}

Ubuntu:Pro:20.04:LTS

librabbitmq

Package

Name: librabbitmq
Purl: pkg:deb/ubuntu/librabbitmq?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.0-1ubuntu0.20.04.1~esm1

Affected versions

0.*

0.9.0-0.2

0.9.0-0.2ubuntu1

0.10.0-1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "0.10.0-1ubuntu0.20.04.1~esm1",
            "binary_name": "amqp-tools"
        },
        {
            "binary_version": "0.10.0-1ubuntu0.20.04.1~esm1",
            "binary_name": "librabbitmq4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8724-1.json"

cves_map

{
    "ecosystem": "Ubuntu:Pro:20.04:LTS",
    "cves": [
        {
            "id": "CVE-2023-35789",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "low"
                }
            ]
        },
        {
            "id": "CVE-2026-44235",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-44236",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-59986",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2026-61547",
            "severity": [
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ]
}