EUVD-2026-80941Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Client-side flaw needing a rogue broker or MITM able to alter Connection.Tune, so AC:H; no auth (PR:N); availability-only crash (A:H), no C/I impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.
AnalysisAI
Memory exhaustion in the RabbitMQ Java client (all versions prior to 5.34.0) lets a rogue AMQP broker or an in-path attacker crash the JVM host application: when both the client's default ConnectionFactory.DEFAULT_FRAME_MAX and the server's Connection.Tune frame_max negotiate to 0, the library's maxInboundMessageBodySize cap is silently discarded and an oversized inbound frame is allocated without limit. Attackers cannot force this against a passive, correctly connected client - the victim must connect outbound to attacker-influenced infrastructure, or the attacker must hold a man-in-the-middle position able to rewrite the Connection.Tune frame and inject frames, which the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both treat as an unauthenticated, availability-only denial of service with no code execution or data exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be either the AMQP server the client connects to (a malicious/rogue broker) or an active man-in-the-middle on the AMQP connection who can alter the Connection.Tune frame and inject frames. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor scores this 8.7 (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) as a pure availability DoS (CWE-770 unbounded allocation), and the impact is real - an oversized frame causes Frame.readFrom() to allocate a large byte array before validation, terminating the JVM client via memory exhaustion. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the RabbitMQ Java client to 5.34.0 or later (released as tag v5.34.0), which is the vendor-released patch containing the Utils.inboundFrameMax() fix and the negative-frameMax validation in AMQConnection.start(); the two upstream commits 6d7c2bfe89796ca34d3531098fb59dd657fea39e and e7f10bf99aee103dd9f64b3e52a725fc9f9d3763 and pull requests #2015/#2016 correspond to this change, and the vendor advisory is at https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Java application in the estate that depends on the com.rabbitmq:amqp-client library, record the resolved library version in each build, and flag any service that connects to a third-party, partner-operated, or externally-hosted AMQP broker as the highest-priority population; confirm which of those connections traverse untrusted or shared networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today