CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-61634

In RabbitMQ Java client prior to 5.33.0, SocketFrameHandler.java and NettyFrameHandlerFactory validate frame payload lengths against maxInboundMessageBodySize instead of the negotiated frame_max, so a malicious broker can send oversized method frames that bypass MalformedFrameException checks, ca...

CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

Summary ValueReader.readTable and readArray recursively call readFieldValue with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure. Vulnerable Code src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249: java priva...

com.github.athieriot:jtaches (>=1.2, <=1.3), com.zanox.lib.rabbiteasy:rabbiteasy-cdi (>=1.0.1, <=1.2.0) +13 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (2.8.7)

com.rabbitmq:amqp-client MAVEN version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.athieriot:jtaches =1.2, =1.0.1, =1.0.1, =1.0.1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m1, =0.5.0-m...

me.breidenbach:rabbitex (1.2) potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.2.0)

com.rabbitmq:amqp-client MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - me.breidenbach:rabbitex 1.2 Source cves: CVE-2026-69220 Source advisory: OSV:GHSA-93J5-89VC-PPH4...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.16.0, <=0.16.5) potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (2.3.1)

com.rabbitmq:amqp-client MAVEN version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.16.0, =0.16.5 Source cves: CVE-2026-69220 Source advisory:...

com.fluxcorp.plugins:rabbitmq-action (>=1.0.2, <=1.0.3), com.fluxcorp.plugins:rabbitmq-trigger (>=1.0.2, <=1.0.3) potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (2.4.1)

com.rabbitmq:amqp-client MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.fluxcorp.plugins:rabbitmq-action =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-69220 Source advisory:...

cn.net.vidyo:jsmth-data (3.3.120.release), cn.net.vidyo:jsmth-msg (3.3.120.release) +6 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (2.8.2)

com.rabbitmq:amqp-client MAVEN version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - cn.net.vidyo:jsmth-data 3.3.120.release - cn.net.vidyo:jsmth-msg 3.3.120.release - cn.net.vidyo:jsmth-orm...

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....

com.github.sstone:akka-amqp-proxies_2.10 (>=1.1-rc1, <=1.3), com.github.sstone:akka-amqp-proxies_2.10.1 (1.2) +1 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.0.1)

com.rabbitmq:amqp-client MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 =1.1-rc1, =1.1-rc1, =1.1 Source cves: CVE-2026-69220 Source advisory:...

org.jenkins-ci.plugins:rabbitmq-build-trigger (>=1.0, <=1.1), org.jenkins-ci.plugins:rabbitmq-consumer (>=1.0, <=1.1) potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.0.3)

com.rabbitmq:amqp-client MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.jenkins-ci.plugins:rabbitmq-build-trigger =1.0, =1.0, =1.1 Source cves: CVE-2026-69220 Source advisory:...

org.elasticsearch:elasticsearch-river-rabbitmq (1.5.0) potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.1.0)

com.rabbitmq:amqp-client MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq 1.5.0 Source cves: CVE-2026-69220 Source advisory:...

io.motown.domain:domain-utils (0.8.2), io.motown.ocpp:ocpp-soap-utils (0.8.2) +7 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.2.3)

com.rabbitmq:amqp-client MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.motown.domain:domain-utils 0.8.2 - io.motown.ocpp:ocpp-soap-utils 0.8.2 - io.motown.ocpp:ocpp-v12-soap 0.8.2...

com.abiquo:commons-amqp (>=3.1.0, <=3.2.0), com.github.sstone:amqp-client_2.10 (>=1.3, <=1.4) +11 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.3.1)

com.rabbitmq:amqp-client MAVEN version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.abiquo:commons-amqp =3.1.0, =1.3, =1.0, =0.9.0, =1.0.0, =0.10.0, =0.7.0-incubating, =0.7.0-incubating,...

com.bq.oss.corbel:evci (1.20.0), com.bq.oss.corbel:event-bus (>=1.19.2, <=1.20.0) +16 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.4.1)

com.rabbitmq:amqp-client MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bq.oss.corbel:evci 1.20.0 - com.bq.oss.corbel:event-bus =1.19.2, =1.19.2, =1.19.2, =1.19.2, =0.1.1, =0.1.0,...

com.bq.corbel.lib:rabbitmq (>=0.9.0, <=0.10.0), com.bq.corbel.lib:ws (>=0.20.0, <=0.23.0) +73 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.5.1)

com.rabbitmq:amqp-client MAVEN version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bq.corbel.lib:rabbitmq =0.9.0, =0.20.0, =1.31.1, =1.27.1, =1.31.0, =1.31.1, =1.31.1, =1.31.1, =1.31.1,...

com.accelerate-experience:storm-rabbitmq (1.0.0), com.github.durre:microservices_2.11 (1.2.3) +20 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.6.1)

com.rabbitmq:amqp-client MAVEN version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.accelerate-experience:storm-rabbitmq 1.0.0 - com.github.durre:microservices2.11 1.2.3 -...