rabbitmq-c heap overflow triggered by malformed AMQP tune frame

CVE-2026-44236 is a heap-based buffer overflow (CWE-122, CVSS 7.1) in rabbitmq-c before 0.16.0. A server-supplied frame_max below the AMQP minimum of 4096 bytes leaves a one-byte buffer, and serialising connection.tune-ok writes past it; an on-path attacker can rewrite the frame on plaintext AMQP. The fix is 0.16.0.

• CVE-2026-44236: heap overflow in rabbitmq-c before 0.16.0, CVSS 7.1
• Client accepts frame_max=1 with no 4096-byte floor
• On-path attacker can rewrite the tune frame on plaintext AMQP
• ZoomEye counts 741,523 RabbitMQ hosts; vulnerable clients not tracked