CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

2023-10-2423:05:24

CWE-400

GitHub_M

www.cve.org

rabbitmq

java client

dos attack

message size limitation

memory overflow

oom error

vulnerability

patched

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

59.0%

JSON

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

CNA Affected

[
  {
    "vendor": "rabbitmq",
    "product": "rabbitmq-java-client",
    "versions": [
      {
        "version": "< 5.18.0",
        "status": "affected"
      }
    ]
  }
]