FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

rabbitmq-c -- remote client-side memory exhaustion

Affected packages
rabbitmq-c < 0.18.0

Details

VuXML ID 03302734-c15d-11f1-8561-107c611e671e
Discovery 2026-09-15
Entry 2026-10-06

The rabbitmq-c project reports:

A malicious AMQP peer can trigger memory exhaustion in rabbitmq-c clients by sending frames with unrecognised types or invalid channel numbers. The client allocates per-channel memory pools and stores complete frames before validating the channel against the negotiated limits or the frame type, and discards unknown frames without releasing that memory, allowing a sustained stream of small frames to exhaust client resources.

References

URL https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-5fp7-wg2f-hhgp