CVE-2026-44235: 
Wolfi vulnerability analysis and mitigation

CVE-2026-44235 is a size_t integer underflow vulnerability in the librabbitmq (rabbitmq-c) AMQP client library that leads to an out-of-bounds read and process crash. It affects rabbitmq-c versions ≤0.15.0, with a patch available in version 0.16.0. The vulnerability was published on June 9, 2026, and was discovered through Anthropic's LLM-assisted vulnerability research, subsequently validated by Trail of Bits. It carries a CVSS v3.1 score of 6.5 (Moderate) (GitHub Advisory, Ubuntu Advisory).

The root cause is an integer underflow (CWE-191) in librabbitmq/amqp_connection.c within the amqp_handle_input() function, which subsequently causes an out-of-bounds read (CWE-125). When parsing AMQP HEADER frames, the code computes encoded.len = state->target_size - HEADER_SIZE - 12 - FOOTER_SIZE as a size_t (unsigned). If a malicious server sends an undersized frame where state->target_size is smaller than HEADER_SIZE + 12 + FOOTER_SIZE, the subtraction wraps around to a very large value (e.g., 0xffffffffffffffff). This corrupted length is then passed to amqp_decode_properties() and the table decoder, bypassing bounds checks and causing the parser to read far past the received frame buffer, resulting in a crash. The same underflow pattern exists for METHOD frames. The vulnerability is exploitable during the AMQP client login flow when connecting to an attacker-controlled server, or via an active network attacker on an unencrypted connection (GitHub Advisory).

The primary demonstrated impact is client-side denial of service: a remote attacker can crash any application using rabbitmq-c as an AMQP client by sending a crafted undersized AMQP frame. The advisory notes that while the crash involves attacker-influenced parsing state and an underflowed length of 0xffffffffffffffff, reliable memory disclosure or code execution has not been demonstrated. Applications connecting to untrusted or attacker-controlled AMQP brokers, or those using unencrypted AMQP connections on untrusted networks, are at greatest risk (GitHub Advisory, Ubuntu Advisory).

A proof-of-concept reproducer was developed and verified using OSS-Fuzz with AddressSanitizer against the vulnerable commit, and is included in the GitHub Security Advisory. No evidence of in-the-wild exploitation has been reported. The vulnerability requires the victim application to connect to an attacker-controlled AMQP server (requiring user interaction) or an active network attacker on an unencrypted connection, which limits opportunistic exploitation. The CVE is detected by Nessus (plugin 320344, 320890, 321367) and Qualys (plugin 6280229). No CISA KEV listing or threat actor attribution has been identified (GitHub Advisory, Tenable).

1. Set up a malicious AMQP server: Deploy a custom AMQP server (or modify an existing one) capable of sending crafted, undersized AMQP HEADER or METHOD frames to connecting clients.
2. Lure or redirect the victim client: Either socially engineer a victim application to connect to the attacker-controlled AMQP broker, or perform a man-in-the-middle attack on an unencrypted AMQP connection (port 5672) to intercept and modify traffic.
3. Send a crafted undersized AMQP frame: During the AMQP login handshake, send a HEADER frame where target_size is smaller than HEADER_SIZE + 12 + FOOTER_SIZE (e.g., 19 bytes as in the PoC). This triggers the size_t underflow in amqp_handle_input().
4. Trigger out-of-bounds read and crash: The underflowed encoded.len (e.g., 0xffffffffffffffff) is passed to amqp_decode_properties() and the table decoder, causing the parser to read far past the frame buffer, resulting in a SIGSEGV and process crash (denial of service) (GitHub Advisory).

• Process: Unexpected crash or SIGSEGV of an application using librabbitmq/librabbitmq4 during AMQP connection or login phase; core dumps referencing amqp_handle_input, amqp_decode_properties, or amqp_decode_table_internal in the stack trace.
• Logs: Application logs showing abrupt termination or connection failures to an AMQP broker, particularly during the login handshake; AddressSanitizer output referencing amqp_d8, amqp_decode_8, or amqp_decode_table_internal.
• Network: AMQP traffic (port 5672) containing unusually small HEADER or METHOD frames from the broker side; connections to unknown or unexpected AMQP server IP addresses (GitHub Advisory).

Upgrade rabbitmq-c to version 0.16.0, which contains the fix for this vulnerability. Ubuntu users should update to the patched package versions: librabbitmq4 0.15.0-1ubuntu0.26.04.1 (Ubuntu 26.04 LTS), 0.15.0-1ubuntu0.25.10.1 (Ubuntu 25.10), 0.11.0-1ubuntu0.1 (Ubuntu 24.04 LTS), or 0.10.0-1ubuntu2.1 (Ubuntu 22.04 LTS) via a standard system update. As a workaround, ensure all AMQP connections use TLS with certificate validation to prevent network-based attackers from injecting malicious frames, and avoid connecting to untrusted AMQP brokers (GitHub Advisory, Ubuntu Advisory).

The vulnerability was discovered as part of Anthropic's research into using large language models for automated vulnerability discovery in open source software; Anthropic then engaged Trail of Bits to independently triage and validate the findings. The GitHub advisory credits kevin-valerio as the reporter. No significant broader media coverage or social media discussion has been identified beyond the official advisory and Linux distribution security notices (GitHub Advisory).