CVE-2026-63335

Overview

The RabbitMQ Java Client is the RabbitMQ team's AMQP 0.9.1 client library, which allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. It is published to Maven Central as com.rabbitmq:amqp-client, and Spring AMQP applications, including Spring Boot ones, use it through spring-rabbit's CachingConnectionFactory.

A denial of service vulnerability (CVE-2026-63335) has been identified in the inbound command assembly of the RabbitMQ Java Client, which allows a malicious or compromised broker peer to terminate frame processing and close the client connection by sending a body frame larger than the body size declared in the preceding content header. All work using that connection is interrupted.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects RabbitMQ Java Client versions prior to 5.31.0.

‍

Details

Module Info

• Product: RabbitMQ Java Client
• Affected packages: com.rabbitmq:amqp-client
• Affected versions: <5.31.0
• GitHub repository: https://github.com/rabbitmq/rabbitmq-java-client
• Published packages: https://central.sonatype.com/artifact/com.rabbitmq/amqp-client
• Package manager: Maven
• Fixed in:
  
  • OSS RabbitMQ Java Client 5.31.0
  • NES for RabbitMQ Java Client v5.24.2

Vulnerability Info

This Medium-severity vulnerability is found in the com.rabbitmq:amqp-client package in RabbitMQ Java Client versions prior to 5.31.0.

Inbound frames read from the broker connection by AMQConnection's main loop are dispatched to the channel and handed to the channel's CommandAssembler. When a content-bearing method arrives, consumeHeaderFrame stores the body size declared by the peer's content header in remainingBodyBytes, checking it only against the configured maximum inbound message body size. Each following body frame is then processed by consumeBodyFrame:

private void consumeBodyFrame(Frame f) {
    if (f.type == AMQP.FRAME_BODY) {
        byte[] fragment = f.getPayload();
        this.remainingBodyBytes -= fragment.length;
        updateContentBodyState();
        if (this.remainingBodyBytes < 0) {
            throw new UnsupportedOperationException("%%%%%% FIXME unimplemented");
        }
        appendBodyFragment(fragment);
    } else {
        throw new UnexpectedFrameError(f, AMQP.FRAME_BODY);
    }
}

The peer-controlled payload length is subtracted before anything checks that it fits in the remaining expected body. A content header that declares a small body, followed by a larger body frame on an open nonzero channel, drives remainingBodyBytes negative and reaches the raw UnsupportedOperationException placeholder instead of a protocol-level MalformedFrameException. The exception escapes frame processing, and AMQConnection handles it as a connection failure and shuts the connection down. The application loses the connection and every channel on it.

‍

Mitigation

The RabbitMQ team lists the AMQP 0.9.1 Java Client 5.x series as currently supported and ships fixes in new 5.x releases. Upstream has made no 5.24.x release since 5.24.0 (December 2024), so no 5.24.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a release of the RabbitMQ Java Client 5.x series that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Brian (finder)