RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
Summary
ValueReader.readBytes() allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.
Vulnerable Code
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 83-95:
private static byte[] readBytes(final DataInputStream in) throws IOException {
final long contentLength = unsignedExtend(in.readInt());
if(contentLength < Integer.MAX_VALUE) {
final byte[] buffer = new byte[(int)contentLength]; // allocates before reading
in.readFully(buffer);
return buffer;
}
}Attack Scenario
A malicious AMQP server sends a LongString field (type tag 'S') with declared length 0x7FFFFFFE (2,147,483,646). The check contentLength < Integer.MAX_VALUE passes. new byte[2147483646] attempts ~2GB allocation, causing OutOfMemoryError before readFully() attempts to read data.
The allocation size is attacker-controlled and is NOT validated against the frame size or TruncatedInputStream bounds. Exploitable pre-authentication via connection.start server-properties table.
Impact
Denial of service via JVM OutOfMemoryError. Crashes the entire JVM.
CWE
CWE-789: Memory Allocation with Excessive Size Value
Remediation
Validate contentLength against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | com.rabbitmq:amqp-client | < 5.33.1 | 5.33.1 |
Referencias
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2007
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2008
- https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0
- https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2
- https://github.com/rabbitmq/rabbitmq-java-client
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-789- Plataforma
- Java / Kotlin (Maven)
- Paquete
com.rabbitmq:amqp-client- Publicada
- 18.08.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-68mj-5wr7-6fgg - CC BY 4.0
Historial de vulnerabilidades: com.rabbitmq:amqp-client
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 10.2018 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 7
- Baja 1
Divulgaciones por año
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 10
-
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.