CVE-2026-61547

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61547", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T16:27:03.094Z", "datePublished": "2026-11-10T16:21:17.565Z", "dateUpdated": "2026-11-10T16:21:17.565Z"}, "containers": {"cna": {"title": "rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "references": [{"name": "https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"}, {"name": "https://github.com/alanxz/rabbitmq-c/pull/892", "tags": ["x_refsource_MISC"], "url": "https://github.com/alanxz/rabbitmq-c/pull/892"}, {"name": "https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0"}], "affected": [{"vendor": "alanxz", "product": "rabbitmq-c", "versions": [{"version": "< 0.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-10T16:21:17.565Z"}, "descriptions": [{"lang": "en", "value": "rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0."}], "source": {"advisory": "GHSA-hfjv-vcp3-39wh", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "rabbitmq-c", "vendor": "alanxz", "versions": [{"status": "affected", "version": "< 0.17.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0."}], "id": "CVE-2026-61547", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-10T17:17:45.650", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/alanxz/rabbitmq-c/pull/892"}, {"source": "security-advisories@github.com", "url": "https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "librabbitmq: rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY", "id": "2570572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570572"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.", "A flaw was found in rabbitmq-c. When serializing an oversized message frame, the library copies payload data into the outbound buffer without verifying that the data fits within the allocated memory. An attacker who can supply an oversized body frame to an application using this library can trigger a heap-based buffer overflow, potentially resulting in memory corruption or an application crash leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-61547", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "librabbitmq", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "librabbitmq", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "librabbitmq", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "librabbitmq", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-10T16:21:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-61547\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61547\nhttps://github.com/alanxz/rabbitmq-c/pull/892\nhttps://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0\nhttps://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"], "statement": "This vulnerability is rated as an Important severity flaw because an application utilizing librabbitmq to send externally supplied data could be forced into a heap corruption state, potentially permitting remote code execution or application crashes. In standard Red Hat Enterprise Linux environments, librabbitmq acts as a client library, meaning exploitation relies on a consuming application transmitting unbounded or untrusted payload sizes without prior validation. Because triggering the flaw requires specific application-level handling of oversized messages rather than default client behavior, successful exploitation depends heavily on the surrounding application logic and memory layout.", "threat_severity": "Important"}

{}