GHSA-68MJ-5WR7-6FGG RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

Summary ValueReader.readBytes allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a 2GB string/bytes field. Vulnerable Code src/main/java/com/rabbitmq/client/impl/ValueReader.java lines...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2) +173 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.0.3)

com.rabbitmq:amqp-client MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1, =1.0.0, =1.0.0, =9.00.2110.07.220316, =1.0.1, =1.0.0, =1.3.6.2,...

net.kieker-monitoring:analysis (>=2.0.0, <=2.0.2), net.kieker-monitoring:monitoring-aspectj (>=2.0.0, <=2.0.2) +6 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.2.1)

com.rabbitmq:amqp-client MAVEN version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - net.kieker-monitoring:analysis =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.20.0, =2.20.0, =2.20.4 -...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.7.0, <=2.7.1), io.zipkin.java:zipkin-collector-rabbitmq (>=2.7.0, <=2.7.1) potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.5.0)

com.rabbitmq:amqp-client MAVEN version 4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.7.0, =2.7.0, =2.7.1 Source cves: CVE-2026-69219 Sourc...

com.smoketurner.dropwizard:zipkin-core (>=1.3.5-2, <=1.3.5-5), io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.2, <=2.11.4) +3 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.7.0)

com.rabbitmq:amqp-client MAVEN version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.5-2, =2.11.2, =2.7.7, =2.7.7, =2.11.2, =2.11.4 Source cves:...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.13, <=2.12.9), io.zipkin.reporter2:zipkin-reporter-spring-beans (>=2.7.15, <=2.8.2) +3 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.10.0)

com.rabbitmq:amqp-client MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.11.13, =2.7.15, =2.7.15, =2.11.13, =2.12.9 -...

io.zipkin.zipkin2:zipkin-collector-rabbitmq (>=2.14.1, <=2.14.2), org.apache.zipkin.reporter2:zipkin-reporter-spring-beans (2.8.3) +2 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.11.0)

com.rabbitmq:amqp-client MAVEN version 4.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.zipkin2:zipkin-collector-rabbitmq =2.14.1, =2.14.2 -...

com.github.marcelop3251:queues-manager (1.2.0), com.rabbitmq.jms:rabbitmq-jms (>=1.13.0, <=1.14.0) +9 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.11.3)

com.rabbitmq:amqp-client MAVEN version 4.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.marcelop3251:queues-manager 1.2.0 - com.rabbitmq.jms:rabbitmq-jms =1.13.0, =1.3.15-1, =2.10.2,...

com.rabbitmq.jms:rabbitmq-jms (>=1.15.0, <=1.15.2), com.smoketurner.dropwizard:zipkin-core (2.0.16-1) +101 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.12.0)

com.rabbitmq:amqp-client MAVEN version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.rabbitmq.jms:rabbitmq-jms =1.15.0, =2.4.2.0-17, =2.4.2.0-17, =2.4.2.0-17, =4.1.3, =4.1.3, =4.1.3, =4.1.3,...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), ai.platon.pulsar:browser4-agent-tools (>=4.13.5, <=4.14.3) +3388 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (>=5.0.0, <=5.33.0)

com.rabbitmq:amqp-client MAVEN version =5.0.0, =0.5.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.3 and more Source cves: CVE-2026-69219 Source advisory: OSV:GHSA-68MJ-5WR7-6FGG...

net.lshift:accent (>=0.1, <=0.9.1) potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (2.6.1)

com.rabbitmq:amqp-client MAVEN version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - net.lshift:accent =0.1, =0.9.1 Source cves: CVE-2026-69219 Source advisory: OSV:GHSA-68MJ-5WR7-6FGG...

com.espertech:esperio-amqp (>=4.6.0, <=7.1.0), io.brooklyn.example:brooklyn-example-global-web-fabric (0.4.0) +9 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (2.7.1)

com.rabbitmq:amqp-client MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.espertech:esperio-amqp =4.6.0, =7.1.0 - io.brooklyn.example:brooklyn-example-global-web-fabric 0.4.0 -...

com.nesscomputing.components:ness-amqp (>=1.0.0, <=1.1.0) potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (2.8.5)

com.rabbitmq:amqp-client MAVEN version 2.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.nesscomputing.components:ness-amqp =1.0.0, =1.1.0 Source cves: CVE-2026-69219 Source advisory:...

com.github.athieriot:jtaches (>=1.2, <=1.3), com.zanox.lib.rabbiteasy:rabbiteasy-cdi (>=1.0.1, <=1.2.0) +13 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (2.8.7)

com.rabbitmq:amqp-client MAVEN version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.athieriot:jtaches =1.2, =1.0.1, =1.0.1, =1.0.1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m...

org.elasticsearch:elasticsearch-river-rabbitmq (1.5.0) potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.1.0)

com.rabbitmq:amqp-client MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq 1.5.0 Source cves: CVE-2026-69219 Source advisory:...

org.apache.airavata:airavata-api-server (>=0.12, <=0.14), org.apache.airavata:airavata-client-api (>=0.9, <=0.14) +30 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.1.2)

com.rabbitmq:amqp-client MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.airavata:airavata-api-server =0.12, =0.9, =0.12, =0.12, =0.12, =0.12, =0.12, =0.12, =0.12, =0.12,...

org.apache.camel:camel-rabbitmq (>=2.13.0, <=2.13.4), org.axonframework:axon-amqp (2.1) +3 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.2.2)

com.rabbitmq:amqp-client MAVEN version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.camel:camel-rabbitmq =2.13.0, =2.1, =2.1, =2.6 Source cves: CVE-2026-69219 Source advisory:...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), com.github.jcustenborder.kafka.connect:kafka-connect-rabbitmq (>=0.0.2.6, <=0.0.2.9) +13 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (4.0.1)

com.rabbitmq:amqp-client MAVEN version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.2.6, =1.1.0, =0.0.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1,...

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

com.github.libgraviton:worker-base (>=0.2.0, <=0.14.0), io.scalac:reactive-rabbit_2.11 (0.1.0) +21 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.3.5)

com.rabbitmq:amqp-client MAVEN version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.libgraviton:worker-base =0.2.0, =0.4.2, =0.5.0 - org.apache.airavata:airavata-gfac-core 0.14 -...