CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

2023-10-2423:05:24

CWE-400

GitHub_M

github.com

rabbitmq

java client

dos attack

message size limitation

vulnerability

memory exhaustion

patch

5.18.0

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

62.1%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rabbitmq:rabbitmq-java-client:*:*:*:*:*:*:*:*"
    ],
    "vendor": "rabbitmq",
    "product": "rabbitmq-java-client",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "5.18.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]