GHSA-93j5-89vc-pph4: Maven/com.rabbitmq:amqp-client vulnerability
Summary
ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
Vulnerable Code
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249:
java private static Map<String, Object> readTable(DataInputStream in) throws IOException { long tableLength = unsignedExtend(in.readInt()); // ... while(tableIn.available() > 0) { String name = readShortstr(tableIn); Object value = readFieldValue(tableIn); // recursive call } }
static Object readFieldValue(DataInputStream in) throws IOException { switch(in.readUnsignedByte()) { case 'F': value = readTable(in); // mutual recursion case 'A': value = readArray(in); // mutual recursion } }
Attack Scenario
A malicious AMQP server (or MitM) sends a connection.start frame with ~580 levels of nested tables. Each level costs ~7 bytes (4-byte length + 1-byte key length + 1-byte key + 1-byte type tag), totaling ~4060 bytes within the 131,072 byte max frame size. With the default JVM stack (~512KB, ~864 bytes/frame), this triggers StackOverflowError, killing the I/O thread.
Exploitable pre-authentication since connection.start is the very first server frame.
Impact
Denial of service. StackOverflowError kills the client I/O thread.
CWE
CWE-674: Uncontrolled Recursion
Remediation
Add a depth counter to readTable/readArray/readFieldValue and throw MalformedFrameException when exceeding a threshold (e.g., 32).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.rabbitmq:amqp-clientto a version that resolves this vulnerability.Fixed in 5.33.1
Event History
Frequently Asked Questions
Who can realistically trigger the crash?
Clients are exposed when they connect to a malicious AMQP server or when an attacker can act as a man-in-the-middle and inject a crafted connection.start frame. The described payload fits within the maximum 131,072-byte frame size.
What does an attacker need to send to exploit this?
The attacker needs to send a deeply nested AMQP table structure, such as roughly 580 levels of nested tables in a connection.start frame. The recursive parsing can exhaust the JVM stack and raise StackOverflowError, killing the I/O thread.
Is a default JVM configuration affected?
Yes. The scenario uses the default JVM stack size of approximately 512 KB and indicates that the crafted nested structure can trigger the failure under that default setting.