Skip to content

GHSA-jgjf-7fwf-f3c7 on CTRL-OS 26.05

Aliases: GHSA-jgjf-7fwf-f3c7

Packages: rabbitmq-c

Status: Plausible

Advisory Information

Vulnerable Code

librabbitmq/amqp_private.h, function amqp_decode_bytes, lines 310-320.

The bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer.

Attack Path

  1. Malicious AMQP broker (or MITM on unencrypted connection) sends a frame containing a table with a BYTES field: length = 0xFFFFFFF5
  2. On 32-bit client: offset o=11, o + len = 11 + 4294967285 = 0 (mod 2^32)
  3. Bounds check: 0 <= encoded.len passes for any non-empty buffer
  4. Decoded bytes object has .len = 4294967285 (~4GB), .bytes = frame_buffer + 11
  5. Application processes the decoded value (amqp_table_clone, logging, comparison) triggering OOB read of up to ~4GB of process memory
  6. Enables information disclosure (heap contents, credentials) or crash (SIGSEGV)

Impact

Out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enables information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. The library's OSS-Fuzz integration only tests 64-bit, missing this class.

Updates

2026-07-27 20:27 CEST

Metadata changes:

  • Status for package rabbitmq-c: “Plausible”

(Amended on: 2026-07-27 23:17 CEST)

2026-07-27 20:26 CEST

Metadata changes:

  • Status for package rabbitmq-c: “New”