RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
Summary
ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
Vulnerable Code
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249:
private static Map<String, Object> readTable(DataInputStream in) throws IOException {
long tableLength = unsignedExtend(in.readInt());
// ...
while(tableIn.available() > 0) {
String name = readShortstr(tableIn);
Object value = readFieldValue(tableIn); // recursive call
}
}
static Object readFieldValue(DataInputStream in) throws IOException {
switch(in.readUnsignedByte()) {
case 'F': value = readTable(in); // mutual recursion
case 'A': value = readArray(in); // mutual recursion
}
}Attack Scenario
A malicious AMQP server (or MitM) sends a connection.start frame with ~580 levels of nested tables. Each level costs ~7 bytes (4-byte length + 1-byte key length + 1-byte key + 1-byte type tag), totaling ~4060 bytes within the 131,072 byte max frame size. With the default JVM stack (~512KB, ~864 bytes/frame), this triggers StackOverflowError, killing the I/O thread.
Exploitable pre-authentication since connection.start is the very first server frame.
Impact
Denial of service. StackOverflowError kills the client I/O thread.
CWE
CWE-674: Uncontrolled Recursion
Remediation
Add a depth counter to readTable/readArray/readFieldValue and throw MalformedFrameException when exceeding a threshold (e.g., 32).
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | com.rabbitmq:amqp-client | < 5.33.1 | 5.33.1 |
Referencias
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2007
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2008
- https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0
- https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc
- https://github.com/rabbitmq/rabbitmq-java-client
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-674- Plataforma
- Java / Kotlin (Maven)
- Paquete
com.rabbitmq:amqp-client- Publicada
- 18.08.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-93j5-89vc-pph4 - CC BY 4.0
Historial de vulnerabilidades: com.rabbitmq:amqp-client
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 10.2018 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 7
- Baja 1
Divulgaciones por año
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 10
-
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.