Allocation of Resources Without Limits or Throttling in RabbitMQ Java Client Library - #VU144580
Published: August 21, 2026
Vulnerability identifier: #VU144580
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in frame handling logic in AMQConnection.java, Utils.java, and Frame.java when processing Connection.Tune negotiation and subsequent crafted frame size fields. A remote attacker can send a malicious Connection.Tune message with frameMax set to 0 and then send an oversized frame to cause a denial of service.
A malicious AMQP server or a machine-in-the-middle position can trigger the issue, and the crafted frame does not need to be a body frame.
Affected software
RabbitMQ Java Client Library
Remediation
Install security update from vendor's website.
RabbitMQ Java Client Library - update to 5.34.0