High

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

Disclosed: 18.08.2026
Updated: 11.10.2026 13:20

Summary

ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.

Vulnerable Code

src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249:

java

private static Map<String, Object> readTable(DataInputStream in) throws IOException {
    long tableLength = unsignedExtend(in.readInt());
    // ...
    while(tableIn.available() > 0) {
        String name = readShortstr(tableIn);
        Object value = readFieldValue(tableIn);  // recursive call
    }
}

static Object readFieldValue(DataInputStream in) throws IOException {
    switch(in.readUnsignedByte()) {
      case 'F': value = readTable(in);  // mutual recursion
      case 'A': value = readArray(in);  // mutual recursion
    }
}

Attack Scenario

A malicious AMQP server (or MitM) sends a connection.start frame with ~580 levels of nested tables. Each level costs ~7 bytes (4-byte length + 1-byte key length + 1-byte key + 1-byte type tag), totaling ~4060 bytes within the 131,072 byte max frame size. With the default JVM stack (~512KB, ~864 bytes/frame), this triggers StackOverflowError, killing the I/O thread.

Exploitable pre-authentication since connection.start is the very first server frame.

Impact

Denial of service. StackOverflowError kills the client I/O thread.

CWE

CWE-674: Uncontrolled Recursion

Remediation

Add a depth counter to readTable/readArray/readFieldValue and throw MalformedFrameException when exceeding a threshold (e.g., 32).

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	com.rabbitmq:amqp-client	< 5.33.1	5.33.1

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-674
Platform: Java / Kotlin (Maven)
Package: com.rabbitmq:amqp-client
Disclosed: 18.08.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-93j5-89vc-pph4 - CC BY 4.0

Vulnerability history: com.rabbitmq:amqp-client

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (12) in the archive

Total entries: 12
First → latest: 10.2018 10.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 7
Low 1

Disclosures per year

2018: 1
2019: 0
2020: 0
2021: 0
2022: 0
2023: 1
2024: 0
2025: 0
2026: 10

17.09.2026

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

High CVE-2026-75516 < 5.34.0 5.34.0
18.08.2026

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

High CVE-2026-63337 < 5.33.0 5.33.0
18.08.2026

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

High CVE-2026-69219 < 5.33.1 5.33.1
18.08.2026

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS this entry

High CVE-2026-69220 < 5.33.1 5.33.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application