Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61634— RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

Quick assessment

Affected
rabbitmq rabbitmq-java-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RabbitMQ rabbitmq-java-client是RabbitMQ组织的一款信息化产品。 RabbitMQ rabbitmq-java-client 5.33.0之前版本存在输入验证错误漏洞，该漏洞源于AMQP连接调整路径未通过setMaxInboundFramePayloadSize一致应用协商的帧大小限制，SocketFrameHandler和NettyFrameHandlerFactory继续验证broker控制的帧负载长度，恶意或受损broker可发送超过协商frame_max的方法帧，

EPSS 0.30% · P23

Possible ATT&CK Techniques 1 AI

T1499.002 · Service Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
rabbitmq rabbitmq-java-client < 5.33.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61634

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Source: CVE Program / CVE List V5
Vulnerability Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with MalformedFrameException. The protocol violation can disrupt the affected connection and cause client-side denial of service. This issue is fixed in version 5.33.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
RabbitMQ rabbitmq-java-client 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
RabbitMQ rabbitmq-java-client是RabbitMQ组织的一款信息化产品。 RabbitMQ rabbitmq-java-client 5.33.0之前版本存在输入验证错误漏洞，该漏洞源于AMQP连接调整路径未通过setMaxInboundFramePayloadSize一致应用协商的帧大小限制，SocketFrameHandler和NettyFrameHandlerFactory继续验证broker控制的帧负载长度，恶意或受损broker可发送超过协商frame_max的方法帧，
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rabbitmq rabbitmq-java-client < 5.33.0 -

II. Public POCs for CVE-2026-61634

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61634

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61634 (4)

Vendor Advisories for CVE-2026-61634 (1)

Vendor Pages for CVE-2026-61634 (1)

Same Patch Batch · rabbitmq · 2026-08-18 · 6 CVEs total

CVE-2026-69219 8.7 HIGH RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unche
CVE-2026-69220 8.7 HIGH RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOver
CVE-2026-63337 7.5 HIGH RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables a
CVE-2026-63335 6.3 MEDIUM RabbitMQ Java client malformed body frame triggers raw command assembler exception
CVE-2026-63336 5.1 MEDIUM RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enab

IV. Related Vulnerabilities

Same product: rabbitmq-java-client
Same vendor: rabbitmq
Same weakness: CWE-20

V. Comments for CVE-2026-61634

No comments yet

Leave a comment