BSD Portsrabbitmq-c -- remote client-side memory exhaustion
The rabbitmq-c project reports: A malicious AMQP peer can trigger memory exhaustion in rabbitmq-c clients by sending frames with unrecognised types or invalid channel numbers. The client allocates per-channel memory pools and stores complete frames before validating the channel against the negotiated limits or the frame type, and discards unknown frames without releasing that memory, allowing a sustained stream of …
Affected versions
- rabbitmq-c < 0.18.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/rabbitmq-c | 0.15.0 | vulnerable since 2026-10-06 | |
| OpenBSD | net/rabbitmq-c | 0.18.1 | out of range, by version | |
| NetBSD | net/rabbitmq-c | 0.15.0 | not listed | |
| MidnightBSD | net/rabbitmq-c | 0.13.0 | in range, by version | |
| FreeBSD | net/rabbitmq-c | 0.18.1 | fixed |