CVE-2026-69219

Received Received - Intake

OutOfMemoryError in RabbitMQ Java Client Library

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-69219

EUVD

EUVD-2026-61041

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq_java_client	5.33.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

The RabbitMQ Java client library before version 5.33.1 has a flaw in ValueReader.readBytes. It allocates a large byte array based on a declared content length without first verifying available bytes. A malicious AMQP peer can exploit this by sending a LongString or byte-array with a declared length near Integer.MAX_VALUE during connection setup, causing a 2 GB allocation and JVM crash due to OutOfMemoryError.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or JVM crashes during RabbitMQ client connections. Check logs for OutOfMemoryError exceptions in RabbitMQ clients. Monitor network traffic for unusually large AMQP frames or pre-authentication connection.start messages with large declared lengths.

Impact Analysis

This vulnerability can cause denial of service by crashing the JVM when processing malicious input. Applications using vulnerable RabbitMQ Java client versions may become unresponsive or terminate unexpectedly, disrupting services relying on RabbitMQ for messaging.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining service availability, and HIPAA mandates reliable access to protected health information. A JVM crash from this issue could violate these requirements by causing prolonged downtime or data unavailability.

Mitigation Strategies

Upgrade the RabbitMQ Java client library to version 5.33.1 or later. If upgrading is not immediately possible, restrict network access to RabbitMQ servers to trusted sources only. Monitor for suspicious connection attempts and implement rate limiting on AMQP connections.

Hi! I’m here to help you understand CVE-2026-69219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70