CVE-2026-61634: CVE-2026-61634: Heap Memory Exhaustion in RabbitMQ Java Client

#security #cve #cybersecurity

CVE-2026-61634: Heap Memory Exhaustion in RabbitMQ Java Client

Vulnerability ID: CVE-2026-61634
CVSS Score: 0.0
Published: 2026-08-18

An improper input validation vulnerability (CWE-20) in the RabbitMQ Java Client prior to version 5.33.0 allows a compromised or malicious AMQP broker to trigger heap memory exhaustion and Denial of Service in client applications during the connection handshake.

TL;DR

Unpatched RabbitMQ Java Clients allocate JVM heap memory based on untrusted frame headers before validating negotiated limits, enabling malicious brokers to trigger Denial of Service via Heap Exhaustion.

Technical Details

CWE ID: CWE-20
Attack Vector: Network
CVSS Base Score: 0.0 (Officially evaluated as 0.0, functions as Medium/High in practice)
Exploit Maturity: PoC / None Active
Impact: Denial of Service (Heap Memory Exhaustion)
CISA KEV Status: Not Listed

Affected Systems

RabbitMQ Java Client applications
JVM-based services interacting with RabbitMQ
rabbitmq-java-client: < 5.33.0 (Fixed in: 5.33.0)

Code Analysis

Commit: 08790f0

Bound inbound frames to the negotiated frame_max

Commit: d04ae45

Initialize reader with minimal frame size and check limit before allocation

Mitigation Strategies

Upgrade the rabbitmq-java-client dependency to 5.33.0 or higher.
Decrease maxInboundMessageBodySize on the ConnectionFactory to limit maximum memory allocation.
Enforce strict TLS configuration with mutual authentication to prevent connections to untrusted brokers.

Remediation Steps:

Identify all JVM microservices using com.rabbitmq:amqp-client.
Modify Maven or Gradle dependency versions to 5.33.0.
Deploy updated microservice containers to production environments.

References

Read the full report for CVE-2026-61634 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community