Executive brief
RabbitMQ's Java client library processes AMQP protocol messages from message brokers. A malicious or compromised broker can send specially crafted frame sequences that cause the client to throw an unhandled exception and terminate the connection, denying service to applications relying on that connection. This affects applications using the Java client to communicate with any broker, including third-party or untrusted endpoints.
Technical details
The vulnerability exists in the CommandAssembler class's frame handling logic. When processing AMQP frames, the code accepts a content header frame that declares a body size and stores it in remainingBodyBytes without sufficient validation. The subsequent body frame processing subtracts the received payload length before checking if it exceeds the declared size, allowing the remaining count to go negative. This triggers a raw UnsupportedOperationException at CommandAssembler.consumeBodyFrame lines 150-151. The exception propagates uncaught to AMQConnection's frame processing loop, which catches it and forcibly closes the AMQP connection. Attack requires the client to have an open channel receiving server-to-client methods like basic.deliver from the broker; no authentication bypass or code execution occurs, only denial of service through connection termination. Patches are available in version 5.31.0 and later.
Affected products
- RabbitMQ Java client 5.30.0 and earlier
Timeline
- 2026-07-09: disclosed: Published to GitHub Advisory Database
- 2026-07-09: patched: Patch released in version 5.31.0
- 2026-08-18: advisory: Updated on GitHub Advisory Database