CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.

## Summary `ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field. ## Vulnerable Code `src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95: ```java private static byte[] readBytes(final DataInputStream in) throws IOException { final long contentLength = unsignedExtend(in.readInt()); if(contentLength < Integer.MAX_VALUE) { final byte[] buffer = new byte[(int)contentLength]; // allocates before reading in.readFully(buffer); return buffer; } } ``` ## Attack Scenario A malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength < Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data. The allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table. ## Impact Denial of service via JVM `OutOfMemoryError`. Crashes the entire JVM. ## CWE CWE-789: Memory Allocation with Excessive Size Value ## Remediation Validate `contentLength` against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.

## Summary `ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field. ## Vulnerable Code `src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95: ```java private static byte[] readBytes(final DataInputStream in) throws IOException { final long contentLength = unsignedExtend(in.readInt()); if(contentLength < Integer.MAX_VALUE) { final byte[] buffer = new byte[(int)contentLength]; // allocates before reading in.readFully(buffer); return buffer; } } ``` ## Attack Scenario A malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength < Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data. The allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table. ## Impact Denial of service via JVM `OutOfMemoryError`. Crashes the entire JVM. ## CWE CWE-789: Memory Allocation with Excessive Size Value ## Remediation Validate `contentLength` against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.

La biblioteca cliente Java de RabbitMQ permite a las aplicaciones Java y basadas en JVM conectarse e interactuar con nodos RabbitMQ. Antes de la versión 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java utiliza ValueReader.readBytes para aceptar una contentLength declarada por cable por debajo de Integer.MAX_VALUE y asignar un array de bytes antes de verificar los bytes disponibles en el frame. Un par AMQP malicioso puede enviar un campo LongString o de array de bytes con la etiqueta de tipo S y una longitud declarada como 0x7FFFFFFE durante la tabla de propiedades del servidor connection.start de pre-autenticación, causando una asignación de aproximadamente 2 GB y un OutOfMemoryError antes de que readFully consuma los datos. El agotamiento de memoria resultante puede terminar la JVM y causar denegación de servicio. Este problema está solucionado en la versión 5.33.1.