CVE-2026-69219

Overview

The RabbitMQ Java Client is the RabbitMQ team's AMQP 0.9.1 client library, which allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. It is published to Maven Central as com.rabbitmq:amqp-client, and Spring AMQP applications, including Spring Boot ones, use it through spring-rabbit's CachingConnectionFactory.

A denial of service vulnerability (CVE-2026-69219) has been identified in the RabbitMQ Java Client's AMQP field-value reader, which allows attackers to exhaust the client's memory by declaring an oversized length for a long string or byte-array field. A malicious AMQP peer can trigger an OutOfMemoryError before authentication, during connection setup, which can terminate the client application's JVM.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects RabbitMQ Java Client versions prior to 5.33.1.

Details

Module Info

• Product: RabbitMQ Java Client
• Affected packages: com.rabbitmq:amqp-client
• Affected versions: <5.33.1
• GitHub repository: https://github.com/rabbitmq/rabbitmq-java-client
• Published packages: https://central.sonatype.com/artifact/com.rabbitmq/amqp-client
• Package manager: Maven
• Fixed in:
  • OSS RabbitMQ Java Client 5.33.1
  • NES for RabbitMQ Java Client v5.24.2

Vulnerability Info

This High-severity vulnerability is found in the com.rabbitmq:amqp-client package in RabbitMQ Java Client versions prior to 5.33.1.

The client decodes AMQP field tables and method arguments with com.rabbitmq.client.impl.ValueReader. Long strings (field type S) and byte arrays (field type x) are both read by readBytes, which takes a 32-bit length prefix from the wire and allocates a buffer of that size before reading any data:

private static byte[] readBytes(final DataInputStream in)
    throws IOException
{
    final long contentLength = unsignedExtend(in.readInt());
    if(contentLength < Integer.MAX_VALUE) {
        final byte [] buffer = new byte[(int)contentLength];
        in.readFully(buffer);
        return buffer;
    } else {
        throw new UnsupportedOperationException
            ("Very long byte vectors and strings not currently supported");
    }
}

The only check is that the declared length is below Integer.MAX_VALUE. It is never compared with the number of bytes actually left in the frame, so a field that declares a length such as 0x7FFFFFFE while carrying almost no data makes the client attempt a roughly 2 GB allocation. The OutOfMemoryError is raised by the allocation itself, before readFully can fail on the short input.

A malicious AMQP server, or anything able to answer the client's connection in its place, can place such a field in the server-properties table of the connection.start method. The client parses that table at the start of the handshake, before it sends credentials, so the attack needs no authentication. The resulting memory exhaustion can terminate the JVM that hosts the client.

Mitigation

The RabbitMQ team lists the AMQP 0.9.1 Java Client 5.x series as currently supported and ships fixes in new 5.x releases. Upstream has made no 5.24.x release since 5.24.0 (December 2024), so no 5.24.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a release of the RabbitMQ Java Client 5.x series that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Henry Wynn (finder)