CVE-2023-46120— RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Quick assessment
Affected
rabbitmq rabbitmq-java-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ是RabbitMQ开源的一个功能丰富的多协议消息和流媒体代理。 RabbitMQ Java client 5.18.0之前版本存在安全漏洞，该漏洞源于允许Java和基于JVM的应用程序连接到RabbitMQ节点并与之交互，攻击者可能会发送非常大的消息，导致内存溢出并触发OOM错误。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-46120
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Source: CVE Program / CVE List V5
Vulnerability Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
RabbitMQ 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RabbitMQ是RabbitMQ开源的一个功能丰富的多协议消息和流媒体代理。 RabbitMQ Java client 5.18.0之前版本存在安全漏洞，该漏洞源于允许Java和基于JVM的应用程序连接到RabbitMQ节点并与之交互，攻击者可能会发送非常大的消息，导致内存溢出并触发OOM错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-java-client | < 5.18.0 | - |
|
II. Public POCs for CVE-2023-46120
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-46120
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-46120 (1)
Vendor Advisories for CVE-2023-46120 (1)
Other References for CVE-2023-46120 (2)
-
https://github.com/rabbitmq/rabbitmq-java-client/issues/1062 x_refsource_MISC
IV. Related Vulnerabilities
Same product: rabbitmq-java-client
-
CVE-2026-75516
RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMe -
CVE-2026-61634
RabbitMQ Java client accepts broker frames larger than the n -
CVE-2026-63336
RabbitMQ Java client: TrustEverythingTrustManager used by de -
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC -
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-400
-
CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SV -
CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allow -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-103760
Mooncake transfer engine through 0.3.13.post1 Denial of Serv -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool
V. Comments for CVE-2023-46120
No comments yet