Mageia alert MGASA-2026-0314 (librabbitmq) [LWN.net]

From:		Mageia Updates
To:		updates-announce@ml.mageia.org
Subject:		[updates-announce] MGASA-2026-0314: Updated librabbitmq packages fix security vulnerabilities
Date:		Mon, 03 Aug 2026 20:48:06 +0200
Message-ID:		<20260803184806.D84D29FEBB@duvel.mageia.org>
Archive-link:		Article

MGASA-2026-0314 – Updated librabbitmq packages fix security vulnerabilities

Publication date: 03 Aug 2026
URL: advisories.mageia.org/MGASA-2026-0314.html
Type: security
Affected Mageia releases: 10, 9
CVE: CVE-2023-35789,
CVE-2026-44235,
CVE-2026-44236

Description:
The updated packages fix security vulnerabilities:
An issue was discovered in the C AMQP client library (aka rabbitmq-c)
through 0.13.0 for RabbitMQ. Credentials can only be entered on the
command line (e.g., for amqp-publish or amqp-consume) and are thus
visible to local attackers by listing a process and its arguments.
(CVE-2023-35789)
size_t underflow in AMQP frame length computation leads to out-of-bounds
read in rabbitmq-c. (CVE-2026-44235)
Heap buffer overflow in AMQP login handshake via undersized
connection.tune.frame_max. (CVE-2026-44236)

References:
– bugs.mageia.org/show_bug.cgi?id=35702
– lists.debian.org/debian-security-announce/2026/ms…
– github.com/alanxz/rabbitmq-c/security/advisories/…
– github.com/alanxz/rabbitmq-c/security/advisories/…
–
lists.fedoraproject.org/archives/list/package-ann…
– ubuntu.com/security/notices/USN-8437-1
– www.cve.org/CVERecord?id=CVE-2023-35789
– www.cve.org/CVERecord?id=CVE-2026-44235
– www.cve.org/CVERecord?id=CVE-2026-44236

SRPMS:
– 10/core/librabbitmq-0.15.0-2.1.mga10
– 9/core/librabbitmq-0.11.0-1.1.mga9