CVE-2026-59986: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-59986 is a size_t integer overflow vulnerability in the amqp_decode_bytes function of the rabbitmq-c client library that bypasses bounds checking on 32-bit systems, leading to an out-of-bounds (OOB) read. It affects rabbitmq-c versions up to and including 0.16.0, with a fix available in version 0.17.0. The vulnerability was published on July 2, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in librabbitmq/amqp_private.h within the amqp_decode_bytes function (lines 310–320), which leads to an out-of-bounds read (CWE-125). The bounds check (*offset = o + len) <= encoded.len overflows on 32-bit systems when o + len exceeds SIZE_MAX (e.g., offset o=11 plus a malicious len=0xFFFFFFF5 wraps to 0 mod 2^32), causing the check to pass for any non-empty buffer. The resulting decoded amqp_bytes_t object has a .len of approximately 4 GB pointing into a small frame buffer, which is then read by callers such as amqp_table_clone, logging routines, or comparison functions. Exploitation requires a malicious AMQP broker or a man-in-the-middle (MITM) attacker on an unencrypted connection to send a crafted frame containing a table with a BYTES field of length 0xFFFFFFF5. The vulnerability is not exploitable on 64-bit systems where size_t is 64-bit (GitHub Advisory).

Successful exploitation on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients) can result in an OOB read of up to approximately 4 GB of process memory, enabling information disclosure of heap contents — potentially including credentials or other sensitive data — or a denial of service via a SIGSEGV crash. Integrity is not directly impacted, but confidentiality and availability are both rated High. Embedded and IoT environments running 32-bit AMQP clients are the primary at-risk asset scope (GitHub Advisory).

1. Identify target: Locate 32-bit systems (ARM, MIPS, x86 ILP32, or embedded IoT devices) running rabbitmq-c version 0.16.0 or earlier that connect to an AMQP broker over an unencrypted connection.
2. Establish attacker-controlled broker or MITM position: Either operate a malicious AMQP broker that the target client connects to, or intercept an unencrypted AMQP session between the client and a legitimate broker.
3. Craft malicious AMQP frame: Construct an AMQP frame containing a table with a BYTES/UTF8 field whose length is set to 0xFFFFFFF5 (4294967285).
4. Send the frame to the client: Deliver the crafted frame to the 32-bit rabbitmq-c client. The amqp_decode_bytes function computes o + len = 11 + 4294967285 = 0 (mod 2^32), which passes the bounds check 0 <= encoded.len.
5. Trigger OOB read: The client processes the decoded amqp_bytes_t object (e.g., via amqp_table_clone, logging, or comparison), reading up to ~4 GB of process memory beyond the frame buffer.
6. Achieve objective: Collect disclosed heap memory contents (potentially including credentials or session tokens) or cause a SIGSEGV crash for denial of service (GitHub Advisory).

• Network: AMQP traffic containing frames with BYTES/UTF8 field length values near 0xFFFFFFF5 (4294967285); unexpected or unauthorized AMQP broker connections from client systems.
• Process: SIGSEGV or segmentation fault crashes in processes using the rabbitmq-c library on 32-bit systems; abnormal memory access patterns in AMQP client processes.
• Logs: Application crash logs or core dumps from rabbitmq-c client processes referencing amqp_decode_bytes, amqp_table_clone, or related functions; unexpected process termination events on 32-bit AMQP clients.

Upgrade rabbitmq-c to version 0.17.0, which contains the fix for this vulnerability. As a workaround where upgrading is not immediately possible, enforce TLS/encrypted AMQP connections to prevent MITM exploitation, and ensure clients only connect to trusted, verified AMQP brokers. Organizations running 32-bit embedded or IoT AMQP clients should prioritize patching given the elevated risk profile for that architecture (GitHub Advisory).

The advisory credits TristanInSec as the reporter and thesmartshadow as the finder. The advisory also notes that the library's OSS-Fuzz integration only tests 64-bit builds, which caused this class of 32-bit integer overflow to be missed — a finding that highlights a gap in fuzzing coverage for embedded/IoT targets (GitHub Advisory). No broader media coverage or significant social media discussion has been identified at this time.