CVE-2026-63335
Received Received - Intake

Denial of Service in RabbitMQ Java Client Library

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection. This issue is fixed in version 5.31.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-07
NVD
CVE-2026-63335
EUVD
EUVD-2026-61040

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rabbitmq rabbitmq_java_client 5.31.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the RabbitMQ Java client library versions before 5.31.0. A malicious or compromised RabbitMQ broker can send a malformed AMQP frame where the declared body size is smaller than the actual payload. This causes the client's CommandAssembler to process a negative remaining byte count, throwing an UnsupportedOperationException instead of a proper MalformedFrameException. The client connection then terminates, causing a denial of service for applications using that connection.

Detection Guidance

Monitor RabbitMQ client connections for unexpected disconnections or UnsupportedOperationException errors in logs. Check for malformed AMQP frames by enabling debug logging in the RabbitMQ Java client. Inspect network traffic for unusually large payloads following small declared body sizes.

Impact Analysis

If you use RabbitMQ Java client versions <= 5.30.0, a malicious broker could crash your application by sending a malformed frame. This disrupts all operations relying on that RabbitMQ connection, leading to service outages or failed tasks. The attack requires a compromised broker or attacker-controlled endpoint.

Compliance Impact

This vulnerability primarily impacts availability by causing denial of service through connection termination. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged service disruption could indirectly impact compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade the RabbitMQ Java client library to version 5.31.0 or later. Review and update client configurations to validate incoming frame sizes. Monitor connections for malicious broker peers and restrict access to trusted endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart