CVE-2026-61634
Received Received - Intake

Denial of Service in RabbitMQ Java Client Library

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with MalformedFrameException. The protocol violation can disrupt the affected connection and cause client-side denial of service. This issue is fixed in version 5.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-07
NVD
CVE-2026-61634
EUVD
EUVD-2026-61046

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rabbitmq rabbitmq_java_client 5.33.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The RabbitMQ Java client library before version 5.33.0 fails to consistently enforce the negotiated AMQP frame_max value for inbound frames. A malicious or compromised broker can send method frames larger than the agreed frame_max size, causing the client to process invalid frames instead of rejecting them. This leads to potential denial-of-service conditions by consuming excessive memory and disrupting connections.

Detection Guidance

Detecting this vulnerability requires checking the RabbitMQ Java client version in use. Run: mvn dependency:tree | grep rabbitmq-client or gradle dependencies | grep rabbitmq-client. If the version is below 5.33.0, the system is vulnerable. Monitor logs for MalformedFrameException errors which may indicate attempts to exploit this issue.

Impact Analysis

If you use a vulnerable RabbitMQ Java client version (before 5.33.0), a malicious broker could send oversized frames to crash or degrade the performance of your Java or JVM-based application. This may result in connection failures, increased memory usage, or system unavailability due to resource exhaustion.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through oversized frames, potentially disrupting data processing workflows. GDPR requires ensuring availability of personal data processing systems, while HIPAA mandates safeguards against unauthorized resource exhaustion. The lack of strict frame size validation could violate these requirements by allowing system disruptions.

Mitigation Strategies

Upgrade the RabbitMQ Java client library to version 5.33.0 or later. This version enforces strict validation of frame sizes based on the negotiated frame_max value, preventing oversized frames from being processed. Update all dependencies in your project to ensure compatibility.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart