new file mode 100644
@@ -0,0 +1,145 @@
+From 17f19124ba26f9c924f9ab53bca975cb8673f862 Mon Sep 17 00:00:00 2001
+From: Kevin Valerio <kvalerio@protonmail.com>
+Date: Tue, 28 Apr 2026 13:45:22 +0200
+Subject: [PATCH] fix(connection): enforce minimum frame_max
+
+(cherry picked from commit 4777d0b5c58cb02966a04a85832436bd66ed5d1f)
+
+CVE: CVE-2026-44236
+Upstream-Status: Backport [https://github.com/alanxz/rabbitmq-c/commit/4777d0b5c58cb02966a04a85832436bd66ed5d1f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ README.md | 6 ++++-
+ librabbitmq/amqp_connection.c | 4 +++
+ librabbitmq/amqp_socket.c | 1 +
+ tests/CMakeLists.txt | 5 +++-
+ tests/test_tune_connection.c | 51 +++++++++++++++++++++++++++++++++++
+ 5 files changed, 65 insertions(+), 2 deletions(-)
+ create mode 100644 tests/test_tune_connection.c
+
+diff --git a/README.md b/README.md
+index 7c02d52..2682993 100644
+--- a/README.md
++++ b/README.md
+@@ -133,6 +133,10 @@ terminal window:
+ Please see the `examples` directory for short examples of the use of
+ the `librabbitmq` library.
+
++During login, `frame_max` negotiation follows the AMQP minimum frame size.
++Values below `AMQP_FRAME_MIN_SIZE` are raised before the client sizes its
++outbound frame buffer or sends `connection.tune-ok`.
++
+ ### Threading
+
+ You cannot share a socket, an `amqp_connection_state_t`, or a channel
+@@ -177,4 +181,4 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+-SOFTWARE.
+\ No newline at end of file
++SOFTWARE.
+diff --git a/librabbitmq/amqp_connection.c b/librabbitmq/amqp_connection.c
+index 4326ef7..f016fc1 100644
+--- a/librabbitmq/amqp_connection.c
++++ b/librabbitmq/amqp_connection.c
+@@ -113,6 +113,10 @@ int amqp_tune_connection(amqp_connection_state_t state, int channel_max,
+
+ ENFORCE_STATE(state, CONNECTION_STATE_IDLE);
+
++ if (frame_max < AMQP_FRAME_MIN_SIZE) {
++ frame_max = AMQP_FRAME_MIN_SIZE;
++ }
++
+ state->channel_max = channel_max;
+ state->frame_max = frame_max;
+
+diff --git a/librabbitmq/amqp_socket.c b/librabbitmq/amqp_socket.c
+index 094ceb7..a7206c7 100644
+--- a/librabbitmq/amqp_socket.c
++++ b/librabbitmq/amqp_socket.c
+@@ -1387,6 +1387,7 @@ static amqp_rpc_reply_t amqp_login_inner(amqp_connection_state_t state,
+ if (res < 0) {
+ goto error_res;
+ }
++ client_frame_max = (uint32_t)amqp_get_frame_max(state);
+
+ {
+ amqp_connection_tune_ok_t s;
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index 8c0aee0..624e7f5 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -23,6 +23,10 @@ add_executable(test_status_enum
+ target_link_libraries(test_status_enum rabbitmq-static)
+ add_test(status_enum test_status_enum)
+
++add_executable(test_tune_connection test_tune_connection.c)
++target_link_libraries(test_tune_connection rabbitmq-static)
++add_test(tune_connection test_tune_connection)
++
+ add_executable(test_basic
+ test_basic.c)
+ target_link_libraries(test_basic rabbitmq-static)
+@@ -40,4 +44,3 @@ add_test(sasl_mechanism test_sasl_mechanism)
+ add_executable(test_merge_capabilities test_merge_capabilities.c)
+ target_link_libraries(test_merge_capabilities rabbitmq-static)
+ add_test(merge_capabilities test_merge_capabilities)
+-
+diff --git a/tests/test_tune_connection.c b/tests/test_tune_connection.c
+new file mode 100644
+index 0000000..276e18d
+--- /dev/null
++++ b/tests/test_tune_connection.c
+@@ -0,0 +1,51 @@
++// Copyright 2007 - 2021, Alan Antonuk and the rabbitmq-c contributors.
++// SPDX-License-Identifier: mit
++
++#include "amqp_private.h"
++#include <rabbitmq-c/amqp.h>
++#include <rabbitmq-c/framing.h>
++
++#include <stdio.h>
++#include <stdlib.h>
++
++static void expect_frame_max(int requested, int expected) {
++ int res;
++ amqp_connection_state_t state = amqp_new_connection();
++
++ if (state == NULL) {
++ fprintf(stderr, "amqp_new_connection failed\n");
++ abort();
++ }
++
++ state->state = CONNECTION_STATE_IDLE;
++
++ res = amqp_tune_connection(state, 0, requested, 0);
++ if (res != AMQP_STATUS_OK) {
++ fprintf(stderr, "amqp_tune_connection returned %d\n", res);
++ abort();
++ }
++
++ if (amqp_get_frame_max(state) != expected) {
++ fprintf(stderr, "expected frame_max %d, got %d\n", expected,
++ amqp_get_frame_max(state));
++ abort();
++ }
++
++ if (state->outbound_buffer.len != (size_t)expected) {
++ fprintf(stderr, "expected outbound buffer length %d, got %zu\n", expected,
++ state->outbound_buffer.len);
++ abort();
++ }
++
++ amqp_destroy_connection(state);
++}
++
++int main(void) {
++ expect_frame_max(0, AMQP_FRAME_MIN_SIZE);
++ expect_frame_max(1, AMQP_FRAME_MIN_SIZE);
++ expect_frame_max(AMQP_FRAME_MIN_SIZE - 1, AMQP_FRAME_MIN_SIZE);
++ expect_frame_max(AMQP_FRAME_MIN_SIZE, AMQP_FRAME_MIN_SIZE);
++ expect_frame_max(AMQP_DEFAULT_FRAME_SIZE, AMQP_DEFAULT_FRAME_SIZE);
++
++ return 0;
++}
@@ -5,6 +5,7 @@ LICENSE = "MIT"
SRC_URI = "git://github.com/alanxz/rabbitmq-c.git;branch=master;protocol=https \
file://CVE-2026-44235.patch \
+ file://CVE-2026-44236.patch \
"
SRCREV = "84b81cd97a1b5515d3d4b304796680da24c666d8"