Updated librabbitmq packages fix security vulnerabilities
Publication date: 03 Aug 2026Modification date: 03 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2023-35789 , CVE-2026-44235 , CVE-2026-44236
Description
The updated packages fix security vulnerabilities:
An issue was discovered in the C AMQP client library (aka rabbitmq-c)
through 0.13.0 for RabbitMQ. Credentials can only be entered on the
command line (e.g., for amqp-publish or amqp-consume) and are thus
visible to local attackers by listing a process and its arguments.
(CVE-2023-35789)
size_t underflow in AMQP frame length computation leads to out-of-bounds
read in rabbitmq-c. (CVE-2026-44235)
Heap buffer overflow in AMQP login handshake via undersized
connection.tune.frame_max. (CVE-2026-44236)
References
- https://bugs.mageia.org/show_bug.cgi?id=35702
- https://lists.debian.org/debian-security-announce/2026/msg00254.html
- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-9mmv-r8g3-qp46
- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jh48-qjf5-fx5v
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RVOR7C3KDMOVLKB4FNMSD3YNXP3MG4YD/
- https://ubuntu.com/security/notices/USN-8437-1
- https://www.cve.org/CVERecord?id=CVE-2023-35789
- https://www.cve.org/CVERecord?id=CVE-2026-44235
- https://www.cve.org/CVERecord?id=CVE-2026-44236
SRPMS
10/core
- librabbitmq-0.15.0-2.1.mga10
9/core
- librabbitmq-0.11.0-1.1.mga9