{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/amqp-client--5.34.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rabbitmq:amqp-client:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-75516"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["amqp-client (\u003c 5.34.0)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","denial-of-service","java","rabbitmq"],"_cs_type":"advisory","_cs_vendors":["RabbitMQ"],"content_html":"\u003cp\u003eThe RabbitMQ Java client library (com.rabbitmq:amqp-client) is vulnerable to an Out-Of-Memory (OOM) denial-of-service condition due to a logic flaw in how it negotiates the maximum frame size (\u003ccode\u003eframeMax\u003c/code\u003e) with an AMQP server. When an AMQP server or an adversary in a Man-in-the-Middle (MITM) position sends a \u003ccode\u003eConnection.Tune\u003c/code\u003e handshake with \u003ccode\u003eframeMax=0\u003c/code\u003e (signifying unlimited size per the AMQP specification), the client incorrectly executes \u003ccode\u003eMath.min(maxInboundMessageBodySize, 0)\u003c/code\u003e. This operation results in a value of zero, which the internal \u003ccode\u003eUtils.framePayloadLimit\u003c/code\u003e function interprets as a request for \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e. Consequently, the client's existing frame size protections are bypassed, and a single crafted frame with a large size field forces the JVM to attempt an allocation of approximately 2GB, causing the process to crash. This affects all clients using versions prior to 5.34.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initiates a connection to the RabbitMQ Java client as a malicious AMQP server.\u003c/li\u003e\n\u003cli\u003eThe client initiates the standard AMQP \u003ccode\u003eConnection.Tune\u003c/code\u003e handshake negotiation.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u003ccode\u003eConnection.Tune\u003c/code\u003e response with the \u003ccode\u003eframeMax\u003c/code\u003e field set to 0.\u003c/li\u003e\n\u003cli\u003eThe client's \u003ccode\u003eAMQConnection\u003c/code\u003e logic incorrectly evaluates the limit as 0 instead of falling back to the configured \u003ccode\u003emaxInboundMessageBodySize\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe client sets the effective frame payload limit to \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e due to the misinterpretation of 0-means-unlimited.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a frame (method, header, or body) with a manipulated size field set to a very large value (e.g., 0x1FFFFFFF).\u003c/li\u003e\n\u003cli\u003eThe client executes \u003ccode\u003enew byte[frameSize]\u003c/code\u003e inside \u003ccode\u003eFrame.readFrom()\u003c/code\u003e based on the attacker's supplied size.\u003c/li\u003e\n\u003cli\u003eThe JVM exhausts available heap memory, resulting in an OOM crash and denial of service for the client application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate denial-of-service (DoS) condition on any application using the vulnerable RabbitMQ Java client. Because the crash occurs during frame processing, it is highly effective against any client connecting to a compromised or malicious AMQP broker. This impacts all sectors relying on RabbitMQ for messaging, particularly in Java-based microservices architectures where a single crashed node can disrupt downstream message processing.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the \u003ccode\u003ecom.rabbitmq:amqp-client\u003c/code\u003e library to version 5.34.0 or later immediately to incorporate the corrected logic for \u003ccode\u003eframeMax\u003c/code\u003e negotiation. If patching is not immediately feasible, ensure that connections are only established to trusted brokers and inspect outbound traffic for anomalous \u003ccode\u003eConnection.Tune\u003c/code\u003e frames.\u003c/p\u003e\n","date_modified":"2026-09-17T19:14:52Z","date_published":"2026-09-17T19:14:52Z","id":"https://feed.craftedsignal.io/briefs/2026-09-rabbitmq-frame-oom/","summary":"A logic error in the RabbitMQ Java client's frame size negotiation allows a malicious server to trigger a massive memory allocation and service crash by exploiting an integer comparison flaw in frame handling.","title":"RabbitMQ Java Client Out-of-Memory Vulnerability via Frame Negotiation","url":"https://feed.craftedsignal.io/briefs/2026-09-rabbitmq-frame-oom/"}],"language":"en","title":"CraftedSignal Threat Feed - Amqp-Client (\u003c 5.34.0)","version":"https://jsonfeed.org/version/1.1"}