Vulnerability GHSA-rm6m-hrcw-jw33

Summary

A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service (Qos) configuration method. The Qos function accepts signed integers (int) for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers (uint16 and uint32, respectively) when formatting the wire-level frame.

If a developer passes a negative integer (such as -1) to these parameters—frequently intended as a sentinel value meaning "no change" or "no limit"—the application performs an implicit signed-to-unsigned conversion. This wraps the values to their absolute maximum limit ($65535$ and $4294967295$). Consequently, a consumer expecting restricted message delivery rates is suddenly flooded with an unlimited volume of messages, potentially exhausting memory resources and crashing the application.

Attack Vector

An attacker who can manipulate configuration files, environmental variables, or API inputs that dictate client Qos settings can trigger an application-layer Denial of Service:

1. Malicious Input: An attacker sets a service's prefetch configuration parameter to -1.
2. Implicit Overflow: The application initializes the channel, executes Qos(-1, ...), and transmits an unintended maximum-capacity request to the RabbitMQ/AMQP broker.
3. Consumer Exhaustion: The broker flushes the entire contents of the queue directly into the client consumer's network buffer, bypassing expected application concurrency barriers and inducing a crash.