Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75516— RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Quick assessment

Affected
rabbitmq rabbitmq-java-client
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RabbitMQ Java 客户端库允许 Java 及基于 JVM 的应用程序连接到 RabbitMQ 节点并与其进行交互。在 5.34.0 版本之前， 方法在执行 协商后，会应用 ，尽管 AMQP 协议定义 值为零表示“无限制”，且 的默认值也为零。 当客户端默认值与服务器协商得到的值均为零时，计算结果会传递给 方法。该方法将零解释为 ，从而禁用了已配置的 上限。 在这种情况下，一个恶意的 AMQP 服务器，或能够修改 消息并向连接中注入帧的中间人（MitM）攻击者，可以发送任意帧类型超大帧。这会导致 方法在内容

CVSS 8.7 · High EPSS 0.55% · P46

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
rabbitmq rabbitmq-java-client < 5.34.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75516

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Source: CVE Program / CVE List V5
Vulnerability Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
rabbitmq rabbitmq-java-client < 5.34.0 -

II. Public POCs for CVE-2026-75516

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75516

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75516 (4)

Other References for CVE-2026-75516 (2)

Same Patch Batch · rabbitmq · 2026-09-16 · 11 CVEs total

CVE-2026-77411 9.5 CRITICAL RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow i
CVE-2026-77405 9.4 CRITICAL RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
CVE-2026-77408 9.1 CRITICAL RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Over
CVE-2026-77403 8.9 HIGH RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
CVE-2026-77410 8.9 HIGH RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
CVE-2026-77412 8.9 HIGH RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
CVE-2026-77404 8.7 HIGH RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter
CVE-2026-77409 8.2 HIGH RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking
CVE-2026-77406 8.2 HIGH RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Q
CVE-2026-77407 7.0 HIGH RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struc

IV. Related Vulnerabilities

Same product: rabbitmq-java-client
Same vendor: rabbitmq
Same weakness: CWE-770