Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the readBytes method in src/main/java/com/rabbitmq/client/impl/ValueReader.java. An attacker can trigger a JVM OutOfMemoryError by sending an AMQP field or long string with a declared leng...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions through the consumeBodyFrame path in CommandAssembler. An attacker can crash frame processing and tear down the AMQP connection by sending a content header that declares a small body...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in ValueReader table and array parsing. An attacker can crash the client JVM by sending a deeply nested AMQP field value, such as a connection.start frame containing recursively nested tables or arrays. The issue...

CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

DEBIAN-CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

DEBIAN-CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

DEBIAN-CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

GHSA-5XWG-CFVJ-GFF5 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

Summary The max body size was enforced to patch CVE-2023-46120, but even though that limit still works, the frame size itself still exceeds the given max size. Root cause The Java client records the AMQP 0-9-1 framemax negotiated during connection tuning, but the socket inbound frame reader...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

org.elasticsearch:elasticsearch-river-rabbitmq (1.5.0) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.1.0)

com.rabbitmq:amqp-client MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq 1.5.0 Source cves: CVE-2026-63336 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-63336 Source advisory:...

cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-plugin-event-stream (>=a.1.1.1, <=a.2.0.0) +15 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.8.3)

com.rabbitmq:amqp-client MAVEN version 4.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.springcloud.gray:spring-cloud-gray-plugin-event-stream =a.1.1.1, =a.1.1.1, =1.11.0, =1.3.7-2, =1.19.1,...

com.cisco.oss.foundation.queue:queue-rabbitmq (>=1.5.3-2, <=1.5.4-8), com.devebot.opflow:opflow-core (>=0.1.4, <=0.1.21) +50 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.1.0)

com.rabbitmq:amqp-client MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.cisco.oss.foundation.queue:queue-rabbitmq =1.5.3-2, =0.1.4, =0.1.0, =0.5, =0.5, =0.1-m1, =0.1-m1, =5.3.0.12...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), com.github.jcustenborder.kafka.connect:kafka-connect-rabbitmq (>=0.0.2.6, <=0.0.2.9) +13 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.0.1)

com.rabbitmq:amqp-client MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.2.6, =1.1.0, =0.0.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1,...

com.nesscomputing.components:ness-amqp (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (2.8.5)

com.rabbitmq:amqp-client MAVEN version 2.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.nesscomputing.components:ness-amqp =1.0.0, =1.1.0 Source cves: CVE-2026-63336 Source advisory:...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.16.0, <=0.16.5) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (2.3.1)

com.rabbitmq:amqp-client MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.16.0, =0.16.5 Source cves: CVE-2026-63336 Source advisory:...

eu.socialsensor:socialsensor-framework-client (0.1) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.0.0)

com.rabbitmq:amqp-client MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - eu.socialsensor:socialsensor-framework-client 0.1 Source cves: CVE-2026-63336 Source advisory:...