Home / mailings [USN-8724-1] rabbitmq-c vulnerabilities
Posted on 03 September 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-8724-1
September 03, 2026
librabbitmq vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in rabbitmq-c.
Software Description:
- librabbitmq: AMQP client library written in C
Details:
It was discovered that the rabbitmq-c command-line tools only accepted
credentials on the command line, making them visible to other local users
through the process list. An attacker could possibly use this to obtain
sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2023-35789)
It was discovered that rabbitmq-c did not correctly compute AMQP frame
lengths, leading to a size_t underflow. A remote attacker could possibly
use this to cause rabbitmq-c to crash, resulting in a denial of service, or
possibly expose sensitive information. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44235)
It was discovered that rabbitmq-c did not properly validate the frame size
during the AMQP login handshake. A remote attacker could possibly use this
to cause a heap buffer overflow, resulting in a denial of service or
possibly the execution of arbitrary code. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2026-44236)
It was discovered that rabbitmq-c did not correctly validate the length of
decoded bytes fields, leading to an integer overflow in a bounds check on
32-bit systems. A remote attacker controlling a broker, or able to
intercept an unencrypted connection, could possibly use this to cause an
out-of-bounds read, resulting in a denial of service or the exposure of
sensitive information. (CVE-2026-59986)
It was discovered that rabbitmq-c did not validate the body fragment length
when serialising an AMQP body frame with the amqp_send_frame() API. An
attacker could possibly use this to cause a heap buffer overflow, resulting
in a denial of service (application crash) or possibly the execution of
arbitrary code. This issue did not affect Ubuntu 14.04 LTS.
(CVE-2026-61547)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
amqp-tools 0.15.0-1ubuntu0.26.04.2
librabbitmq-dev 0.15.0-1ubuntu0.26.04.2
librabbitmq4 0.15.0-1ubuntu0.26.04.2
Ubuntu 24.04 LTS
amqp-tools 0.11.0-1ubuntu0.2
librabbitmq-dev 0.11.0-1ubuntu0.2
librabbitmq4 0.11.0-1ubuntu0.2
Ubuntu 22.04 LTS
amqp-tools 0.10.0-1ubuntu2.2
librabbitmq-dev 0.10.0-1ubuntu2.2
librabbitmq4 0.10.0-1ubuntu2.2
Ubuntu 20.04 LTS
amqp-tools 0.10.0-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
librabbitmq-dev 0.10.0-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
librabbitmq4 0.10.0-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
amqp-tools 0.8.0-1ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
librabbitmq-dev 0.8.0-1ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
librabbitmq4 0.8.0-1ubuntu0.18.04.2+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
amqp-tools 0.7.1-1ubuntu0.2+esm1
Available with Ubuntu Pro
librabbitmq-dev 0.7.1-1ubuntu0.2+esm1
Available with Ubuntu Pro
librabbitmq4 0.7.1-1ubuntu0.2+esm1
Available with Ubuntu Pro
Ubuntu 14.04 LTS
amqp-tools 0.4.1-1ubuntu0.1~esm2
Available with Ubuntu Pro
librabbitmq-dev 0.4.1-1ubuntu0.1~esm2
Available with Ubuntu Pro
librabbitmq1 0.4.1-1ubuntu0.1~esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-8724-1
CVE-2023-35789, CVE-2026-44235, CVE-2026-44236, CVE-2026-59986,
CVE-2026-61547
Package Information:
https://launchpad.net/ubuntu/+source/librabbitmq/0.15.0-1ubuntu0.26.04.2
https://launchpad.net/ubuntu/+source/librabbitmq/0.11.0-1ubuntu0.2
https://launchpad.net/ubuntu/+source/librabbitmq/0.10.0-1ubuntu2.2
--===============4524154062962358048==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
