Executive brief
The RabbitMQ Java client library uses a faulty frame size negotiation mechanism that can be exploited by a malicious AMQP server or network attacker. When a server sends an "unlimited" frame size (0 per AMQP spec), the client incorrectly treats this as a zero value in a Math.min() call, defeating the 64MB inbound message size limit that protects against unbounded memory allocation. An attacker can send a single malicious frame up to ~500MB in size, causing the client to attempt an allocation of up to 2GB and crash with out-of-memory.
Technical details
The vulnerability exists in AMQConnection.java where the effective frame size limit is calculated using Math.min(maxInboundMessageBodySize, frameMax). When the AMQP server's frameMax is 0 (meaning "unlimited" per the AMQP 0-9-1 spec), Math.min(67108864, 0) incorrectly returns 0. This value is then passed to Utils.framePayloadLimit(0), which returns Integer.MAX_VALUE for any frameMax ≤ 0, completely disabling frame-level size enforcement. The attack vector is network-based and requires no authentication or user interaction: a malicious or compromised AMQP server sends Connection.Tune with frameMax=0, then transmits a frame with crafted size fields (up to 0x1FFFFFFF bytes). Frame.readFrom() attempts to allocate memory for this frame size before any content validation occurs, triggering an out-of-memory crash. The root cause is a semantic mismatch: the AMQP spec uses 0-means-unlimited, but the Java Math.min() function treats 0 as the lowest numeric value. Patched in version 5.34.0 by conditionally checking for frameMax==0 and using maxInboundMessageBodySize as the fallback limit.
Affected products
- RabbitMQ Java AMQP client < 5.34.0
Timeline
- 2026-07-10: disclosed: Published in GitHub Advisory Database
- 2026-09-16: advisory: Added to National Vulnerability Database
- 2026-09-17: patched: Fixed in rabbitmq-java-client v5.34.0
References
- https://api.github.com/users/lucianjohnhouse
- https://github.com/lucianjohnhouse
- https://api.github.com/users/lucianjohnhouse/gists%7B/gist_id%7D
- https://api.github.com/users/lucianjohnhouse/repos
- https://avatars.githubusercontent.com/u/244141656?v=4
- https://api.github.com/users/lucianjohnhouse/events%7B/privacy%7D