CVE-2026-75516: RabbitMQ Java client frame-level OOM via Math.min with unlimited semantics

CVE-2026-75516 · Severity: high · CVSS 4 · Published 2026-09-16

The RabbitMQ Java client library uses a faulty frame size negotiation mechanism that can be exploited by a malicious AMQP server or network attacker. When a server sends an "unlimited" frame size (0 per AMQP spec), the client incorrectly treats this as a zero value in a Math.min() call, defeating the 64MB inbound message size limit that protects against unbounded memory allocation. An attacker can send a single malicious frame up to ~500MB in size, causing the client to attempt an allocation of up to 2GB and crash with out-of-memory.

Technologies: com.rabbitmq:amqp-client (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-75516 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75516 being exploited in the wild.
How severe is CVE-2026-75516?
High severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?
com.rabbitmq:amqp-client (Maven) < 5.34.0, ECOSYSTEM:introduced=0,fixed=5.34.0; VMware Java AMQP client < 5.34.0.
Is there a fix for CVE-2026-75516?
Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75516 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-75516?
Check whether you run com.rabbitmq:amqp-client (Maven) or VMware Java AMQP client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.rabbitmq:amqp-client (Maven): upgrade to 5.34.0 or later
    # set com.rabbitmq:amqp-client to 5.34.0 in your pom.xml or build.gradle

Technical details

The vulnerability exists in AMQConnection.java where the effective frame size limit is calculated using Math.min(maxInboundMessageBodySize, frameMax). When the AMQP server's frameMax is 0 (meaning "unlimited" per the AMQP 0-9-1 spec), Math.min(67108864, 0) incorrectly returns 0. This value is then passed to Utils.framePayloadLimit(0), which returns Integer.MAX_VALUE for any frameMax ≤ 0, completely disabling frame-level size enforcement. The attack vector is network-based and requires no authentication or user interaction: a malicious or compromised AMQP server sends Connection.Tune with frameMax=0, then transmits a frame with crafted size fields (up to 0x1FFFFFFF bytes). Frame.readFrom() attempts to allocate memory for this frame size before any content validation occurs, triggering an out-of-memory crash. The root cause is a semantic mismatch: the AMQP spec uses 0-means-unlimited, but the Java Math.min() function treats 0 as the lowest numeric value. Patched in version 5.34.0 by conditionally checking for frameMax==0 and using maxInboundMessageBodySize as the fallback limit.

Affected products

  • RabbitMQ Java AMQP client < 5.34.0

Identifiers

  • CVE-2026-75516
  • GHSA-jh4v-gfqj-7rhx

Timeline

  • 2026-07-10: disclosed: Published in GitHub Advisory Database
  • 2026-09-16: advisory: Added to National Vulnerability Database
  • 2026-09-17: patched: Fixed in rabbitmq-java-client v5.34.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.