# CVE-2026-75516: RabbitMQ Java client frame-level OOM via Math.min with unlimited semantics

Source: https://junglewise.ai/threats/cve-2026-75516-rabbitmq-java-client-frame-level-oom-via-math-min-with-unlimited  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75516 · Severity: high · CVSS 4 · Published 2026-09-16

The RabbitMQ Java client library uses a faulty frame size negotiation mechanism that can be exploited by a malicious AMQP server or network attacker. When a server sends an "unlimited" frame size (0 per AMQP spec), the client incorrectly treats this as a zero value in a Math.min() call, defeating the 64MB inbound message size limit that protects against unbounded memory allocation. An attacker can send a single malicious frame up to ~500MB in size, causing the client to attempt an allocation of up to 2GB and crash with out-of-memory.

Technologies: [com.rabbitmq:amqp-client (Maven)](https://junglewise.ai/threats/technologies/com-rabbitmq-amqp-client). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-75516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75516 being exploited in the wild.

**How severe is CVE-2026-75516?** High severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** com.rabbitmq:amqp-client (Maven) < 5.34.0, ECOSYSTEM:introduced=0,fixed=5.34.0; VMware Java AMQP client < 5.34.0.

**Is there a fix for CVE-2026-75516?** Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75516 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75516?** Check whether you run com.rabbitmq:amqp-client (Maven) or VMware Java AMQP client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.rabbitmq:amqp-client (Maven): upgrade to 5.34.0 or later

  ```sh
  # set com.rabbitmq:amqp-client to 5.34.0 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in AMQConnection.java where the effective frame size limit is calculated using Math.min(maxInboundMessageBodySize, frameMax). When the AMQP server's frameMax is 0 (meaning "unlimited" per the AMQP 0-9-1 spec), Math.min(67108864, 0) incorrectly returns 0. This value is then passed to Utils.framePayloadLimit(0), which returns Integer.MAX_VALUE for any frameMax ≤ 0, completely disabling frame-level size enforcement. The attack vector is network-based and requires no authentication or user interaction: a malicious or compromised AMQP server sends Connection.Tune with frameMax=0, then transmits a frame with crafted size fields (up to 0x1FFFFFFF bytes). Frame.readFrom() attempts to allocate memory for this frame size before any content validation occurs, triggering an out-of-memory crash. The root cause is a semantic mismatch: the AMQP spec uses 0-means-unlimited, but the Java Math.min() function treats 0 as the lowest numeric value. Patched in version 5.34.0 by conditionally checking for frameMax==0 and using maxInboundMessageBodySize as the fallback limit.

## Affected products

- RabbitMQ Java AMQP client < 5.34.0

## Identifiers

- CVE-2026-75516
- GHSA-jh4v-gfqj-7rhx

## Timeline

- 2026-07-10: disclosed: Published in GitHub Advisory Database
- 2026-09-16: advisory: Added to National Vulnerability Database
- 2026-09-17: patched: Fixed in rabbitmq-java-client v5.34.0

## References

- [https://api.github.com/users/lucianjohnhouse](https://api.github.com/users/lucianjohnhouse)
- [https://github.com/lucianjohnhouse](https://github.com/lucianjohnhouse)
- [https://api.github.com/users/lucianjohnhouse/gists%7B/gist_id%7D](https://api.github.com/users/lucianjohnhouse/gists%7B/gist_id%7D)
- [https://api.github.com/users/lucianjohnhouse/repos](https://api.github.com/users/lucianjohnhouse/repos)
- [https://avatars.githubusercontent.com/u/244141656?v=4](https://avatars.githubusercontent.com/u/244141656?v=4)
- [https://api.github.com/users/lucianjohnhouse/events%7B/privacy%7D](https://api.github.com/users/lucianjohnhouse/events%7B/privacy%7D)

## Related threats

- [RabbitMQ Java client library credential disclosure in error messages](https://junglewise.ai/threats/cve-2026-106123-the-rabbitmq-java-client-library-allows-java-and-jvm-based)
- [RabbitMQ Java client library UTF-8 parsing denial of service](https://junglewise.ai/threats/cve-2026-106122-the-rabbitmq-java-client-library-allows-java-and-jvm-based)
- [RabbitMQ Java client library JSON parser denial of service](https://junglewise.ai/threats/cve-2026-106121-the-rabbitmq-java-client-library-allows-java-and-jvm-based)
- [RabbitMQ Java client protocol violation on oversized frames](https://junglewise.ai/threats/cve-2026-61634-rabbitmq-java-client-protocol-violation-on-oversized-frames)
- [RabbitMQ Java client insecure default TLS certificate validation](https://junglewise.ai/threats/cve-2026-63336-rabbitmq-java-client-insecure-default-tls-certificate-validation)