Junglewise Threat Intelligence

CVE-2026-75516: RabbitMQ Java client frame-level OOM via Math.min with unlimited semantics

CVE-2026-75516 · Severity: high · CVSS 8.7 · Published 2026-09-17

Executive brief

The RabbitMQ Java client library uses a faulty frame size negotiation mechanism that can be exploited by a malicious AMQP server or network attacker. When a server sends an "unlimited" frame size (0 per AMQP spec), the client incorrectly treats this as a zero value in a Math.min() call, defeating the 64MB inbound message size limit that protects against unbounded memory allocation. An attacker can send a single malicious frame up to ~500MB in size, causing the client to attempt an allocation of up to 2GB and crash with out-of-memory.

Technical details

The vulnerability exists in AMQConnection.java where the effective frame size limit is calculated using Math.min(maxInboundMessageBodySize, frameMax). When the AMQP server's frameMax is 0 (meaning "unlimited" per the AMQP 0-9-1 spec), Math.min(67108864, 0) incorrectly returns 0. This value is then passed to Utils.framePayloadLimit(0), which returns Integer.MAX_VALUE for any frameMax ≤ 0, completely disabling frame-level size enforcement. The attack vector is network-based and requires no authentication or user interaction: a malicious or compromised AMQP server sends Connection.Tune with frameMax=0, then transmits a frame with crafted size fields (up to 0x1FFFFFFF bytes). Frame.readFrom() attempts to allocate memory for this frame size before any content validation occurs, triggering an out-of-memory crash. The root cause is a semantic mismatch: the AMQP spec uses 0-means-unlimited, but the Java Math.min() function treats 0 as the lowest numeric value. Patched in version 5.34.0 by conditionally checking for frameMax==0 and using maxInboundMessageBodySize as the fallback limit.

Affected products

  • RabbitMQ Java AMQP client < 5.34.0

Timeline

  • 2026-07-10: disclosed: Published in GitHub Advisory Database
  • 2026-09-16: advisory: Added to National Vulnerability Database
  • 2026-09-17: patched: Fixed in rabbitmq-java-client v5.34.0

References

Related threats