Critical Heap Buffer Overflow in librabbitmq Package Leading to Denial of Service
Summary
RLSA-2026:84795: Important: librabbitmq security update. Affects librabbitmq versions < 0:0.14.0-3.el10_2.1. Fixed in 0:0.14.0-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The librabbitmq package is an Advanced Message Queuing Protocol (AMQP) client library that enables communication with AMQP servers using protocol version 0-9-1. It is widely used for building applications that require reliable messaging and asynchronous communication. However, a critical vulnerability has been identified that could compromise the stability of applications relying on this library.
Vulnerability Detail
The vulnerability, identified as CVE-2026-44236, is a heap buffer overflow that can lead to a denial of service. This issue arises from improper handling of memory allocation within the librabbitmq library, allowing an attacker to exploit the overflow and crash the application. The ramifications of this vulnerability can be severe, as it may disrupt service availability and affect user experience.
How To Fix
Minimum fixed version
0:0.14.0-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update librabbitmqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting access to the application using librabbitmq or implementing additional security measures to mitigate potential attacks until the package can be updated.
Conclusion
The librabbitmq package has a critical vulnerability that can lead to denial of service due to a heap buffer overflow. It is crucial to update to the patched version to ensure the security and stability of applications using this library. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for librabbitmq →
FAQ
CVE-2026-44236 is a vulnerability in the librabbitmq package that allows for a heap buffer overflow, potentially leading to denial of service.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to application crashes and service disruptions, impacting user experience and system reliability.
Yes, a patched version of the librabbitmq package is available. Update to version 0:0.14.0-3.el10_2.1 to mitigate the vulnerability.
Vulert is a tool that monitors open-source vulnerabilities in your software using a manifest file. It provides real-time alerts for vulnerabilities without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for librabbitmq.
