CVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
Summary
ValueReader.readBytes() allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.
Vulnerable Code
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 83-95:
java private static byte[] readBytes(final DataInputStream in) throws IOException { final long contentLength = unsignedExtend(in.readInt()); if(contentLength < Integer.MAXVALUE) { final byte[] buffer = new byte[(int)contentLength]; // allocates before reading in.readFully(buffer); return buffer; } }
Attack Scenario
A malicious AMQP server sends a LongString field (type tag 'S') with declared length 0x7FFFFFFE (2,147,483,646). The check contentLength < Integer.MAXVALUE passes. new byte[2147483646] attempts ~2GB allocation, causing OutOfMemoryError before readFully() attempts to read data.
The allocation size is attacker-controlled and is NOT validated against the frame size or TruncatedInputStream bounds. Exploitable pre-authentication via connection.start server-properties table.
Impact
Denial of service via JVM OutOfMemoryError. Crashes the entire JVM.
CWE
CWE-789: Memory Allocation with Excessive Size Value
Remediation
Validate contentLength against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.
Other sources
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.rabbitmq:amqp-clientto a version that resolves this vulnerability.Fixed in 5.33.1 - Upgrade
Upgrade
RabbitMQ Java client (com/rabbitmq/client)to a version that resolves this vulnerability.Fixed in 5.33.1 - Compensating control
Mitigate pre-authentication DoS by limiting network access to the AMQP service (e.g., firewall/ACL restrictions so untrusted peers cannot reach the RabbitMQ node’s AMQP port).
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Java and JVM-based applications using RabbitMQ Java client versions earlier than 5.33.1 are exposed when they connect to a malicious AMQP peer. The issue can be triggered during the pre-authentication connection.start exchange, before client credentials are processed.
What does an attacker need to exploit this?
An attacker needs to operate, impersonate, or otherwise cause the client to connect to a malicious AMQP peer that sends a crafted server-properties table. No authentication is required because the malformed LongString or byte-array field is processed before authentication.
What should be done to remediate the issue?
Upgrade the RabbitMQ Java client to version 5.33.1, which fixes the unchecked allocation behavior. The provided data does not identify a separate configuration workaround.