High

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

Disclosed: 18.08.2026
Updated: 11.10.2026 13:20

Summary

ValueReader.readBytes() allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.

Vulnerable Code

src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 83-95:

java

private static byte[] readBytes(final DataInputStream in) throws IOException {
    final long contentLength = unsignedExtend(in.readInt());
    if(contentLength < Integer.MAX_VALUE) {
        final byte[] buffer = new byte[(int)contentLength];  // allocates before reading
        in.readFully(buffer);
        return buffer;
    }
}

Attack Scenario

A malicious AMQP server sends a LongString field (type tag 'S') with declared length 0x7FFFFFFE (2,147,483,646). The check contentLength < Integer.MAX_VALUE passes. new byte[2147483646] attempts ~2GB allocation, causing OutOfMemoryError before readFully() attempts to read data.

The allocation size is attacker-controlled and is NOT validated against the frame size or TruncatedInputStream bounds. Exploitable pre-authentication via connection.start server-properties table.

Impact

Denial of service via JVM OutOfMemoryError. Crashes the entire JVM.

CWE

CWE-789: Memory Allocation with Excessive Size Value

Remediation

Validate contentLength against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	com.rabbitmq:amqp-client	< 5.33.1	5.33.1

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-789
Platform: Java / Kotlin (Maven)
Package: com.rabbitmq:amqp-client
Disclosed: 18.08.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-68mj-5wr7-6fgg - CC BY 4.0

Vulnerability history: com.rabbitmq:amqp-client

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive

Total entries: 12
First → latest: 10.2018 10.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 7
Low 1

Disclosures per year

2018: 1
2019: 0
2020: 0
2021: 0
2022: 0
2023: 1
2024: 0
2025: 0
2026: 10

17.09.2026

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

High CVE-2026-75516 < 5.34.0 5.34.0
18.08.2026

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

High CVE-2026-63337 < 5.33.0 5.33.0
18.08.2026

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation this entry

High CVE-2026-69219 < 5.33.1 5.33.1
18.08.2026

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

High CVE-2026-69220 < 5.33.1 5.33.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application