Executive brief
The RabbitMQ Java client library contains a flaw in how it parses AMQP protocol messages with nested tables and arrays. A malicious or compromised message broker can send specially crafted messages with deeply nested data structures that cause the client application to crash, resulting in loss of service to any application relying on the RabbitMQ connection.
Technical details
The vulnerability exists in the ValueReader class in src/main/java/com/rabbitmq/client/impl/ValueReader.java. The methods readTable() and readArray() recursively call readFieldValue() without enforcing a recursion depth limit, allowing unbounded nesting. An attacker controlling or intercepting an AMQP connection can send a connection.start frame (the first frame in AMQP handshake, pre-authentication) containing approximately 580 levels of nested tables, consuming only ~4060 bytes while exhausting the default JVM stack (~512KB). This triggers a StackOverflowError that crashes the client's I/O thread, terminating the connection and halting message processing. The fix involves adding a recursion depth counter that throws MalformedFrameException when nesting exceeds a defined threshold (e.g., 32 levels).
Affected products
- RabbitMQ amqp-client <= 5.33.0
Timeline
- 2026-07-09: disclosed
- 2026-08-18: advisory: Published to GitHub Advisory Database
- 2026: patched: Fixed in version 5.33.1
References
- https://api.github.com/users/lucianjohnhouse
- https://github.com/lucianjohnhouse
- https://api.github.com/users/lucianjohnhouse/gists%7B/gist_id%7D
- https://api.github.com/users/lucianjohnhouse/repos
- https://avatars.githubusercontent.com/u/244141656?v=4
- https://api.github.com/users/lucianjohnhouse/events%7B/privacy%7D