BSD Portsrabbitmq-c -- multiple vulnerabilities
· CVE-2026-61547, CVE-2026-59986 · VuXML entry
The rabbitmq-c project reports: CVE-2026-61547: A heap buffer overflow exists when the amqp_send_frame() API is used to serialise an oversized AMQP_FRAME_BODY frame, as memcpy() writes past the end of the heap allocation without validating that the body fragment fits within the allocated frame buffer. CVE-2026-59986: An integer overflow in the amqp_decode_bytes bounds check on 32-bit systems allows a malicious AMQP …
Affected versions
- rabbitmq-c < 0.17.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/rabbitmq-c | 0.15.0 | vulnerable since 2026-10-06 | |
| OpenBSD | net/rabbitmq-c | 0.18.1 | out of range, by version | |
| NetBSD | net/rabbitmq-c | 0.15.0 | not listed | |
| MidnightBSD | net/rabbitmq-c | 0.13.0 | in range, by version | |
| FreeBSD | net/rabbitmq-c | 0.18.1 | fixed |