The rabbitmq-c library contains three vulnerabilities: CVE-2023-35789 (CVSS 5.5), a local information disclosure via exposed command-line arguments; CVE-2026-44235, a remote denial-of-service via an out-of-bounds read from malformed AMQP frames; and CVE-2026-44236, a critical remote heap buffer overflow during AMQP login that could lead to arbitrary code execution. According to NVD, CVE-2023-35789 affects rabbitmq-c versions up to and including 0.13.0. The article notes that the information disclosure issue specifically impacts Ubuntu 22.04 LTS and 24.04 LTS.
It was discovered that rabbitmq-c exposed credentials in command-line arguments under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-35789) It was discovered that rabbitmq-c incorrectly handled AMQP frame lengths under certain circumstances, which could lead to an out-of-bounds read. A remote attacker could possibly use this issue to cause rabbitmq-c to crash, resulting in a denial of service. (CVE-2026-44235) It was discovered that rabbitmq-c incorrectly handled AMQP login handshakes under certain circumstances, which could lead to a heap buffer overflow. A remote attacker could possibly use this issue to cause rabbitmq-c to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-44236)