Rabbitmq Java Client
Monthly
Unvalidated Class.forName() with initialization enabled in RabbitMQ Java Client's JSON-RPC tooling allows a network-positioned attacker to trigger arbitrary static initializers in the victim JVM. Applications using com.rabbitmq:amqp-client before 5.33.0 that employ the JsonRpcClient class are exposed when an attacker can control or spoof the system.describe broker response - either as a co-tenant on a shared broker or via network interception. Successful exploitation achieves code-like effects through static initializer execution and a secondary type-confusion path via mapper.parse, with full confidentiality, integrity, and availability impact on the client process. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromised AMQP broker to forcibly terminate any active client connection by sending a crafted malformed frame sequence. The flaw in CommandAssembler.consumeBodyFrame subtracts a peer-controlled body-frame payload length before validating it fits within the declared body size, driving remainingBodyBytes negative and triggering an unhandled UnsupportedOperationException - a legacy stub - rather than a proper MalformedFrameException, causing AMQConnection to perform a hard connection shutdown. A PoC is referenced in the GHSA advisory; no active exploitation is confirmed in CISA KEV.
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Unvalidated Class.forName() with initialization enabled in RabbitMQ Java Client's JSON-RPC tooling allows a network-positioned attacker to trigger arbitrary static initializers in the victim JVM. Applications using com.rabbitmq:amqp-client before 5.33.0 that employ the JsonRpcClient class are exposed when an attacker can control or spoof the system.describe broker response - either as a co-tenant on a shared broker or via network interception. Successful exploitation achieves code-like effects through static initializer execution and a secondary type-confusion path via mapper.parse, with full confidentiality, integrity, and availability impact on the client process. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
Unbounded mutual recursion in the RabbitMQ Java client library (amqp-client <= 5.33.0) allows a malicious AMQP server or network intermediary to crash the client JVM before authentication completes. By sending approximately 580 levels of nested AMQP table structures within a single connection.start frame - well within the default 131,072-byte frame limit - an attacker triggers a StackOverflowError that kills the client's I/O processing thread, resulting in denial of service. No public exploit code has been published, but the GHSA advisory includes a precise technical breakdown and proof-of-concept payload specification, significantly lowering the bar for exploitation.
Memory exhaustion denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.33.0) allows a malicious AMQP peer to crash the client JVM by sending a LongString field with a wire-declared length near Integer.MAX_VALUE during the pre-authentication connection.start handshake. The ValueReader.readBytes() method allocates a byte array sized by the attacker-controlled wire value before validating it against actual frame data, causing a ~2 GB allocation and OutOfMemoryError that terminates the entire JVM process. No public exploit code has been identified at time of analysis, but the GHSA advisory discloses the exact vulnerable code path, the precise trigger value (0x7FFFFFFE), and the step-by-step attack scenario, making independent implementation trivial.
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior to version 5.33.0 when applications call `ConnectionFactory.useSslProtocol()` or `useSslProtocol(String)`, because these methods silently install `TrustEverythingTrustManager` and leave hostname verification disabled. A network-positioned attacker can present any certificate - including self-signed or null-chain - to impersonate the RabbitMQ broker and decrypt or modify all AMQP traffic, including plaintext credentials transmitted via PLAIN SASL on default port 5672. A verified proof-of-concept is publicly available in GHSA-5m9f-rphj-c435; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromised AMQP broker to forcibly terminate any active client connection by sending a crafted malformed frame sequence. The flaw in CommandAssembler.consumeBodyFrame subtracts a peer-controlled body-frame payload length before validating it fits within the declared body size, driving remainingBodyBytes negative and triggering an unhandled UnsupportedOperationException - a legacy stub - rather than a proper MalformedFrameException, causing AMQConnection to perform a hard connection shutdown. A PoC is referenced in the GHSA advisory; no active exploitation is confirmed in CISA KEV.
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.