PT-2026-77208
CVE-2026-61634
·
Published
2026-08-18
·
Updated
2026-10-30
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
RabbitMQ Java client library versions prior to 5.33.0
Description
The AMQP connection tuning path records the negotiated AMQP
frame max value, but SocketFrameHandler.java and NettyFrameHandlerFactory validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not consistently applied through setMaxInboundFramePayloadSize(). A malicious or compromised broker can send a method frame exceeding the negotiated frame max during or after connection establishment. This causes the client to allocate and decode a protocol-invalid frame instead of rejecting it with a MalformedFrameException, leading to a protocol violation that can disrupt the connection and cause a client-side denial of service.Recommendations
Update to version 5.33.0.
Found an issue in the description? Have something to add? Feel free to write us 👾