{"id":"CVE-2026-75516","aliases":["DEBIAN-CVE-2026-75516","EUVD-2026-80941","GHSA-jh4v-gfqj-7rhx","ROOT-APP-MAVEN-CVE-2026-75516","UBUNTU-CVE-2026-75516"],"status":"published","title":"RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00552,"percentile":0.46601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-09-16T18:30:58Z","modified":"2026-10-28T11:17:43Z","fixes":[{"ecosystem":"Maven","package":"com.rabbitmq:amqp-client","fixed_in":["5.34.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"com.rabbitmq:amqp-client","fixed_in":["5.27.1-aikido.3","5.27.1-aikido.2","5.30.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.rabbitmq:amqp-client","fixed_in":["5.27.1-root.io.3","5.27.1-root.io.2","5.30.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]},{"source":"osv","ecosystem":"Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0"}]}],"versions":["1.3.0","1.5.4","1.5.5","1.6.0","1.7.2","1.8.0","1.8.1","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","4.0.0","4.0.1","4.0.2","4.0.3","4.1.0","4.1.1","4.10.0","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.2.0","4.2.1","4.2.2","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.9.0","4.9.1","4.9.2","4.9.3","5.0.0","5.1.0","5.1.1","5.1.2","5.10.0","5.11.0","5.12.0","5.13.0","5.13.1","5.14.0","5.14.1","5.14.2","5.14.3","5.15.0","5.16.0","5.16.1","5.17.0","5.17.1","5.18.0","5.19.0","5.2.0","5.20.0","5.21.0","5.22.0","5.23.0","5.24.0","5.25.0","5.26.0","5.27.0","5.27.1","5.28.0","5.29.0","5.3.0","5.30.0","5.31.0","5.32.0","5.33.0","5.33.1","5.4.0","5.4.1","5.4.2","5.4.3","5.5.0","5.5.1","5.5.2","5.5.3","5.6.0","5.7.0","5.7.1","5.7.2","5.7.3","5.8.0","5.9.0"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.27.1-aikido.3"},{"fixed":"5.27.1-aikido.2"},{"fixed":"5.30.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.rabbitmq:amqp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.27.1-root.io.3"},{"fixed":"5.27.1-root.io.2"},{"fixed":"5.30.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rabbitmq-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1.1","5.0.0-2"]}],"products":[{"vendor":"rabbitmq","product":"rabbitmq-java-client"}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2015","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2016","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.34.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75516","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jh4v-gfqj-7rhx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75516.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75516","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-java-client","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-75516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75516","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-75516","title":"RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T18:30:58.983Z","modified":"2026-09-18T18:17:25.002Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-80941","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T18:30:58Z","modified":"2026-09-18T18:17:25Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:07.943492Z"}],"ghsa":[{"id":"GHSA-jh4v-gfqj-7rhx","title":"RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement","description":"## Vulnerability\n\nIn `AMQConnection.java` (line 435-436), after `Connection.Tune` negotiation, the frame-max limit is set via:\n\n```java\n_frameHandler.setFrameMax(\n    Math.min(this.maxInboundMessageBodySize, frameMax));\n```\n\nWhen `frameMax = 0` (meaning \"unlimited\" per AMQP spec), `Math.min(67108864, 0) = 0`. This value is then passed to `Utils.framePayloadLimit(0)` which returns `Integer.MAX_VALUE` (line 77-79 of Utils.java):\n\n```java\nstatic int framePayloadLimit(int frameMax) {\n    if (frameMax \u003c= 0) {\n      return Integer.MAX_VALUE;\n    }\n    // ...\n}\n```\n\nThis completely defeats the `maxInboundMessageBodySize` protection (default 64MB) at the frame level.\n\n## Attack Scenario\n\nA malicious AMQP server (or MITM) sends `Connection.Tune` with `frameMax=0`:\n\n1. Client defaults: `requestedFrameMax = 0` (`ConnectionFactory.DEFAULT_FRAME_MAX`, line 82)\n2. `negotiatedMaxValue(0, 0)` = `Math.max(0, 0)` = 0 (line 673-676)\n3. `Math.min(maxInboundMessageBodySize, 0)` = 0 — **64MB cap defeated**\n4. `framePayloadLimit(0)` = `Integer.MAX_VALUE` — no frame size enforcement\n5. Attacker sends a single frame with `frameSize = 0x1FFFFFFF` (~500MB)\n6. `Frame.readFrom()` (line 135) executes `new byte[frameSize]` — **OOM crash**\n\nThe frame does not need to be a body frame — method frames, header frames, or heartbeat frames with a crafted size field all trigger the allocation before any content-level check fires.\n\n## Root Cause\n\nThe AMQP spec uses `frameMax=0` to mean \"unlimited\", but `Math.min` treats it as the integer value zero. The intent of line 435-436 was to take the smaller of the two limits, but when one limit uses 0-means-unlimited semantics, `Math.min` always selects the zero, disabling the other limit.\n\n## Impact\n\n- **Default configuration is vulnerable**: Both `requestedFrameMax` (client) and legitimate servers' `frameMax` in Tune may be 0\n- **Single-frame OOM**: One malicious frame triggers up to ~2GB allocation (`Integer.MAX_VALUE` bytes)\n- **Bypasses existing protection**: `maxInboundMessageBodySize` (introduced to cap allocations at 64MB) is entirely defeated at the frame level\n- **Different from ValueReader OOM**: This is a frame-layer allocation in `Frame.readFrom()`, not a value-layer allocation in `ValueReader.readBytes()`\n\n## Affected Code\n\n- `AMQConnection.java:435-436` — `Math.min` with 0-means-unlimited\n- `Utils.java:77-79` — `framePayloadLimit(0)` returns `Integer.MAX_VALUE`\n- `Frame.java:135` — `new byte[frameSize]` allocation site\n- `ConnectionFactory.java:82` — `DEFAULT_FRAME_MAX = 0`\n\n## Suggested Fix\n\n```java\nint effectiveFrameMax = (frameMax == 0)\n    ? this.maxInboundMessageBodySize\n    : Math.min(this.maxInboundMessageBodySize, frameMax);\n_frameHandler.setFrameMax(effectiveFrameMax);\n```\n\nThis treats `frameMax=0` as \"use maxInboundMessageBodySize as the cap\" instead of \"zero\".","status":"published","published":"2026-09-17T14:52:21Z","modified":"2026-09-17T14:52:23Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:17.136201Z"}],"nvd":[{"id":"CVE-2026-75516","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T19:17:33.56Z","modified":"2026-09-24T21:16:28.12Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:48.630594Z"}],"osv":[{"id":"CVE-2026-75516","title":"RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T18:30:58.983Z","modified":"2026-10-28T11:17:43.452421875Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-75516","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T19:17:33.56Z","modified":"2026-09-25T08:47:21.993782119Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:03.004924Z"},{"id":"GHSA-jh4v-gfqj-7rhx","title":"RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement","description":"## Vulnerability\n\nIn `AMQConnection.java` (line 435-436), after `Connection.Tune` negotiation, the frame-max limit is set via:\n\n```java\n_frameHandler.setFrameMax(\n    Math.min(this.maxInboundMessageBodySize, frameMax));\n```\n\nWhen `frameMax = 0` (meaning \"unlimited\" per AMQP spec), `Math.min(67108864, 0) = 0`. This value is then passed to `Utils.framePayloadLimit(0)` which returns `Integer.MAX_VALUE` (line 77-79 of Utils.java):\n\n```java\nstatic int framePayloadLimit(int frameMax) {\n    if (frameMax \u003c= 0) {\n      return Integer.MAX_VALUE;\n    }\n    // ...\n}\n```\n\nThis completely defeats the `maxInboundMessageBodySize` protection (default 64MB) at the frame level.\n\n## Attack Scenario\n\nA malicious AMQP server (or MITM) sends `Connection.Tune` with `frameMax=0`:\n\n1. Client defaults: `requestedFrameMax = 0` (`ConnectionFactory.DEFAULT_FRAME_MAX`, line 82)\n2. `negotiatedMaxValue(0, 0)` = `Math.max(0, 0)` = 0 (line 673-676)\n3. `Math.min(maxInboundMessageBodySize, 0)` = 0 — **64MB cap defeated**\n4. `framePayloadLimit(0)` = `Integer.MAX_VALUE` — no frame size enforcement\n5. Attacker sends a single frame with `frameSize = 0x1FFFFFFF` (~500MB)\n6. `Frame.readFrom()` (line 135) executes `new byte[frameSize]` — **OOM crash**\n\nThe frame does not need to be a body frame — method frames, header frames, or heartbeat frames with a crafted size field all trigger the allocation before any content-level check fires.\n\n## Root Cause\n\nThe AMQP spec uses `frameMax=0` to mean \"unlimited\", but `Math.min` treats it as the integer value zero. The intent of line 435-436 was to take the smaller of the two limits, but when one limit uses 0-means-unlimited semantics, `Math.min` always selects the zero, disabling the other limit.\n\n## Impact\n\n- **Default configuration is vulnerable**: Both `requestedFrameMax` (client) and legitimate servers' `frameMax` in Tune may be 0\n- **Single-frame OOM**: One malicious frame triggers up to ~2GB allocation (`Integer.MAX_VALUE` bytes)\n- **Bypasses existing protection**: `maxInboundMessageBodySize` (introduced to cap allocations at 64MB) is entirely defeated at the frame level\n- **Different from ValueReader OOM**: This is a frame-layer allocation in `Frame.readFrom()`, not a value-layer allocation in `ValueReader.readBytes()`\n\n## Affected Code\n\n- `AMQConnection.java:435-436` — `Math.min` with 0-means-unlimited\n- `Utils.java:77-79` — `framePayloadLimit(0)` returns `Integer.MAX_VALUE`\n- `Frame.java:135` — `new byte[frameSize]` allocation site\n- `ConnectionFactory.java:82` — `DEFAULT_FRAME_MAX = 0`\n\n## Suggested Fix\n\n```java\nint effectiveFrameMax = (frameMax == 0)\n    ? this.maxInboundMessageBodySize\n    : Math.min(this.maxInboundMessageBodySize, frameMax);\n_frameHandler.setFrameMax(effectiveFrameMax);\n```\n\nThis treats `frameMax=0` as \"use maxInboundMessageBodySize as the cap\" instead of \"zero\".","status":"published","published":"2026-09-17T14:52:21Z","modified":"2026-09-17T15:00:06.805894716Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2026-75516","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.","status":"published","published":"2026-09-16T19:17:00Z","modified":"2026-10-17T13:01:05.637807213Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-75516","title":"CVE-2026-75516 in com.rabbitmq:amqp-client - Patched by Root","description":"Root has patched CVE-2026-75516 in the com.rabbitmq:amqp-client package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-13T12:14:22Z","modified":"2026-10-13T13:15:03.230766104Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}