GitHub Advisoryadvisory · Maven

GHSA-5xwg-cfvj-gff5 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

LOW Published 2026-08-18 Modified 2026-08-18 Official page ↗
Aliases
CVE-2026-61634
Ecosystem
Maven
Packages
com.rabbitmq:amqp-client
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-20
Reviewed
2026-08-18

Affected packages

• Maven com.rabbitmq:amqp-client: < 5.33.0 → fixed in 5.33.0

Description

Summary The max body size was enforced to patch CVE-2023-46120, but even though that limit still works, the frame size itself still exceeds the given max size. Root cause The Java client records the AMQP 0-9-1 `frame_max` negotiated during connection tuning, but the socket inbound frame reader continues to validate broker-controlled payload lengths against the much larger `maxInboundMessageBodySize` limit. A broker peer can therefore send a method frame whose payload is larger than the negotiated `frame_max`, have it allocated and decoded, and complete the connection handshake instead of being rejected as a protocol violation. *Reported by Team Atlanta.*

Related

Alias · CVE (1)

  • CVE-2026-61634 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References