CVE-2026-63335: RabbitMQ Java client denial of service via malformed AMQP frame

CVE-2026-63335 · Severity: medium · CVSS 4 · Published 2026-08-18

RabbitMQ's Java client library processes AMQP protocol messages from message brokers. A malicious or compromised broker can send specially crafted frame sequences that cause the client to throw an unhandled exception and terminate the connection, denying service to applications relying on that connection. This affects applications using the Java client to communicate with any broker, including third-party or untrusted endpoints.

Technologies: com.rabbitmq:amqp-client (Maven). Vendors: Broadcom, Maven.

Quick answers

Is CVE-2026-63335 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63335 being exploited in the wild.
How severe is CVE-2026-63335?
Medium severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?
Broadcom RabbitMQ Java client 5.30.0 and earlier; com.rabbitmq:amqp-client (Maven) <= 5.30.0, ECOSYSTEM:introduced=0,fixed=5.31.0.
Is there a fix for CVE-2026-63335?
Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.31.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63335 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63335?
Check whether you run Broadcom RabbitMQ Java client or com.rabbitmq:amqp-client (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.rabbitmq:amqp-client (Maven): upgrade to 5.31.0 or later
    # set com.rabbitmq:amqp-client to 5.31.0 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the CommandAssembler class's frame handling logic. When processing AMQP frames, the code accepts a content header frame that declares a body size and stores it in remainingBodyBytes without sufficient validation. The subsequent body frame processing subtracts the received payload length before checking if it exceeds the declared size, allowing the remaining count to go negative. This triggers a raw UnsupportedOperationException at CommandAssembler.consumeBodyFrame lines 150-151. The exception propagates uncaught to AMQConnection's frame processing loop, which catches it and forcibly closes the AMQP connection. Attack requires the client to have an open channel receiving server-to-client methods like basic.deliver from the broker; no authentication bypass or code execution occurs, only denial of service through connection termination. Patches are available in version 5.31.0 and later.

Affected products

  • RabbitMQ Java client 5.30.0 and earlier

Identifiers

  • CVE-2026-63335
  • GHSA-qx7j-jv8m-fppr

Timeline

  • 2026-07-09: disclosed: Published to GitHub Advisory Database
  • 2026-07-09: patched: Patch released in version 5.31.0
  • 2026-08-18: advisory: Updated on GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.