{"affected":[{"product":"rabbitmq-c","source":"CNA: GitHub_M","vendor":"alanxz","versions":[{"status":"affected","version":"< 0.17.0"}]}],"cveId":"CVE-2026-61547","cwes":["CWE-787"],"description":"rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbitmq-c when the public amqp_send_frame() API is used to serialize an oversized AMQP_FRAME_BODY. The issue occurs because amqp_frame_to_bytes() copies frame.payload.body_fragment.len bytes into the connection outbound buffer without validating that the body fragment fits within the allocated frame buffer. An application that passes an oversized body frame to amqp_send_frame() can trigger a heap out-of-bounds write, resulting in process crash and memory corruption. This issue has been patched in version 0.17.0.","epss":{"date":"2026-11-13","percentile":0.33972,"score":0.00393},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"}],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},{"score":9.8,"severity":"critical","source":"NVD: security-advisories@github.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}],"modifiedAt":1794624732997,"publishedAt":1794327677565,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/alanxz/rabbitmq-c/pull/892"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/alanxz/rabbitmq-c/pull/892"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-hfjv-vcp3-39wh"}],"remediation":[],"revision":"13caad70f1208e3d3ee3999f4957df294cbb22fee8aa660d8e2ca49069b35118","sources":[{"modifiedAt":1794624732997,"name":"CNA: GitHub_M","retrievedAt":1794625783624,"url":"https://www.cve.org/CVERecord?id=CVE-2026-61547"},{"modifiedAt":1794521915610,"name":"NVD","retrievedAt":1794529255195,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61547"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794625791794,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61547"}],"ssvc":{"assessedAt":1794624708352,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY","updatedAt":1794625791794}