Vulnerability GHSA-5xwg-cfvj-gff5
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
1 month ago
August 18, 2026 at 04:36 PM UTC
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0
Summary
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max
Details
Summary
The max body size was enforced to patch CVE-2023-46120, but even though that limit still works, the frame size itself still exceeds the given max size.
Root cause
The Java client records the AMQP 0-9-1 frame_max negotiated during connection tuning, but the socket inbound frame reader continues to validate broker-controlled payload lengths against the much larger maxInboundMessageBodySize limit. A broker peer can therefore send a method frame whose payload is larger than the negotiated frame_max, have it allocated and decoded, and complete the connection handshake instead of being rejected as a protocol violation.
Reported by Team Atlanta.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 hours ago
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.34.0 GHSA-h6w7-qmcm-q6xr
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.34.0 GHSA-h6w7-qmcm-q6xr
High Risk
20 days ago
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.33.1 GHSA-jh4v-gfqj-7rhx
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.33.1 GHSA-jh4v-gfqj-7rhx
Medium Risk
1 month ago
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0 GHSA-5m9f-rphj-c435
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0 GHSA-5m9f-rphj-c435
Medium Risk
1 month ago
RabbitMQ Java client malformed body frame triggers raw command assembler exception
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.30.0 GHSA-qx7j-jv8m-fppr
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.30.0 GHSA-qx7j-jv8m-fppr
High Risk
1 month ago
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0 GHSA-6g32-pxv4-2wfj
1.3.0 and 1.5.4 - 1.6.0 and 1.7.2 - 2.3.1 and 2.4.1 - 2.7.1 and 4.1.0 - 4.1.1 and 4.3.0 and 4.5.0 - 4.7.0 and 4.10.0 and 4.12.0 - 5.0.0 and 5.2.0 - 5.3.0 and 5.6.0 and 5.8.0 - 5.13.1 and 5.15.0 - 5.32.0 GHSA-6g32-pxv4-2wfj
Impacted packages
Timeline
Published
1 month ago
August 18, 2026 at 04:36 PM UTC
Fixed (5.33.0)
Unknown
Unknown
Last Modified
27 days ago
September 10, 2026 at 03:51 AM UTC