CVE-2026-59986
rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)
Published Nov 10, 2026
CVSS 3.1 · 7.4 High
EPSS < 1%
KEV · Not listed
Description
rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| alanxz | rabbitmq-c | affected |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4763-1 | librabbitmq security update |
 Debian DSA |
DSA-6447-1 | librabbitmq security update |
 Ubuntu USN |
USN-8724-1 | rabbitmq-c vulnerabilities |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.513% probability within 30 days)
Exploitation poc
Automatable no
Technical Impact partial
References
History
Nov 12, 2026 1:30 AM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Nov 10, 2026 4:30 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0. | |
| Title | rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read) | |
| Weaknesses | CWE-125 CWE-190 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.