CVE-2026-61547: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-61547 is a heap buffer overflow vulnerability in the rabbitmq-c library (librabbitmq) affecting the amqp_send_frame() API when serializing oversized AMQP_FRAME_BODY frames. It affects all versions up to and including 0.16.0, with a fix introduced in version 0.17.0. The vulnerability was published on July 2, 2026, via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.8 (Moderate) (GitHub Advisory).

The root cause is an out-of-bounds write (CWE-787) in amqp_frame_to_bytes() within librabbitmq/amqp_connection.c. When handling an AMQP_FRAME_BODY frame, the function performs a memcpy() of body->len bytes into the connection's outbound frame buffer without first validating that the payload fits within the allocated buffer capacity (default: 65,536 bytes). The vulnerable call chain is: amqp_send_frame() → amqp_send_frame_inner() → amqp_frame_to_bytes() → memcpy(). An attacker or buggy application can manually construct an amqp_frame_t with payload.body_fragment.len set to a value exceeding the buffer size (e.g., 200,000 bytes) and pass it to the public amqp_send_frame() API, triggering a heap out-of-bounds write before any network communication occurs. A public proof-of-concept is included in the advisory (GitHub Advisory).

Successful exploitation results in a heap out-of-bounds write, causing process termination (crash) and potential memory corruption within the affected application. Depending on heap layout, the corruption may extend beyond a simple crash and could theoretically be leveraged for more complex memory exploitation. Confidentiality impact is rated None, while integrity is rated Low and availability is rated High, meaning the primary risk is denial of service to applications using the low-level amqp_send_frame() API with attacker-influenced or insufficiently validated input (GitHub Advisory).

1. Identify target: Locate an application that uses the rabbitmq-c library (version ≤ 0.16.0) and exposes the low-level amqp_send_frame() API to attacker-influenced input.
2. Build or obtain rabbitmq-c: Compile the library (optionally with AddressSanitizer for verification) using the steps provided in the advisory.
3. Construct oversized frame: Manually create an amqp_frame_t struct, set frame.frame_type = AMQP_FRAME_BODY, frame.channel = 1, and assign frame.payload.body_fragment.bytes to a buffer of size greater than 65,536 bytes (e.g., 200,000 bytes).
4. Trigger the overflow: Call amqp_send_frame(conn, &frame) with the oversized frame. The function internally calls amqp_frame_to_bytes(), which performs an unchecked memcpy() of 200,000 bytes into a 65,536-byte heap buffer.
5. Achieve impact: The heap out-of-bounds write corrupts adjacent heap memory, causing a process crash (denial of service) and potential memory corruption effects depending on heap layout (GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in applications linked against librabbitmq, particularly in processes calling amqp_send_frame().
• Logs: AddressSanitizer or crash reports referencing amqp_frame_to_bytes in librabbitmq/amqp_connection.c at line 467, or amqp_send_frame_inner at line 548.
• File System: Core dump files generated by the affected application process following an unexpected termination.
• Process: Abnormal termination signals (SIGABRT, SIGSEGV) from processes using rabbitmq-c when processing large AMQP body frames (GitHub Advisory).

Upgrade rabbitmq-c to version 0.17.0, which introduces bounds validation in amqp_frame_to_bytes() before the memcpy() call, rejecting oversized body frames with AMQP_STATUS_BAD_AMQP_DATA. As a workaround prior to upgrading, applications should validate that body_fragment.len does not exceed the connection's negotiated frame max size before calling amqp_send_frame(). Applications using only the higher-level publishing API (which splits message bodies into valid frame-sized chunks) are less likely to be directly affected (GitHub Advisory).

The vulnerability was reported by security researcher yousif-IQ and published by the rabbitmq-c maintainer (alanxz) via a GitHub Security Advisory on July 2, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory).