CVE-2026-69220: RabbitMQ Java client unbounded recursion in ValueReader

CVE-2026-69220 · Severity: high · CVSS 4 · Published 2026-08-18

The RabbitMQ Java client library contains a flaw in how it parses AMQP protocol messages with nested tables and arrays. A malicious or compromised message broker can send specially crafted messages with deeply nested data structures that cause the client application to crash, resulting in loss of service to any application relying on the RabbitMQ connection.

Technologies: com.rabbitmq:amqp-client (Maven), RabbitMQ Amqp-Client. Vendors: Maven, RabbitMQ.

Quick answers

Is CVE-2026-69220 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69220 being exploited in the wild.
How severe is CVE-2026-69220?
High severity, with a CVSS score of 4, published 18 August 2026.
Which products and versions are affected?
com.rabbitmq:amqp-client (Maven) <= 5.33.0, ECOSYSTEM:introduced=0,fixed=5.33.1; RabbitMQ Amqp-Client <= 5.33.0.
Is there a fix for CVE-2026-69220?
Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.33.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69220 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-69220?
Check whether you run com.rabbitmq:amqp-client (Maven) or RabbitMQ Amqp-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.rabbitmq:amqp-client (Maven): upgrade to 5.33.1 or later
    # set com.rabbitmq:amqp-client to 5.33.1 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the ValueReader class in src/main/java/com/rabbitmq/client/impl/ValueReader.java. The methods readTable() and readArray() recursively call readFieldValue() without enforcing a recursion depth limit, allowing unbounded nesting. An attacker controlling or intercepting an AMQP connection can send a connection.start frame (the first frame in AMQP handshake, pre-authentication) containing approximately 580 levels of nested tables, consuming only ~4060 bytes while exhausting the default JVM stack (~512KB). This triggers a StackOverflowError that crashes the client's I/O thread, terminating the connection and halting message processing. The fix involves adding a recursion depth counter that throws MalformedFrameException when nesting exceeds a defined threshold (e.g., 32 levels).

Affected products

  • RabbitMQ amqp-client <= 5.33.0

Identifiers

  • CVE-2026-69220
  • GHSA-93j5-89vc-pph4

Timeline

  • 2026-07-09: disclosed
  • 2026-08-18: advisory: Published to GitHub Advisory Database
  • 2026: patched: Fixed in version 5.33.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.