Source: rabbitmq-java-client Version: 5.0.0-2 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for rabbitmq-java-client. CVE-2026-61634[0]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.33.0, the AMQP connection tuning path records the negotiated | AMQP frame_max value, but | src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and | NettyFrameHandlerFactory continue to validate broker-controlled | frame payload lengths against maxInboundMessageBodySize because the | negotiated limit is not applied consistently through | setMaxInboundFramePayloadSize. A malicious or compromised broker can | send a method frame larger than the negotiated frame_max during or | after connection establishment, causing the client to allocate and | decode a protocol-invalid frame instead of rejecting it with | MalformedFrameException. The protocol violation can disrupt the | affected connection and cause client-side denial of service. This | issue is fixed in version 5.33.0. CVE-2026-63335[1]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.31.0, inbound AMQP command assembly in | src/main/java/com/rabbitmq/client/impl/CommandAssembler.java | processes a content-bearing method and header whose | remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY | payload. CommandAssembler.consumeBodyFrame subtracts the peer- | controlled payload length before validating that it fits, drives | remainingBodyBytes negative, and throws a raw | UnsupportedOperationException instead of MalformedFrameException. A | malicious or compromised broker peer can send this malformed | sequence on an open nonzero channel to terminate frame processing | and close the client connection, causing denial of service for work | using that connection. This issue is fixed in version 5.31.0. CVE-2026-63336[2]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() | and ConnectionFactory.useSslProtocol(String) configure | com.rabbitmq.client.TrustEverythingTrustManager and leave hostname | verification disabled, causing arbitrary server certificates, | including self-signed certificates, to be accepted. A network | attacker able to intercept a TLS connection can impersonate the | RabbitMQ broker, read protected AMQP traffic, and modify traffic | without certificate or hostname validation. The fix changes the | production TLS helpers to use the JVM default trust store and | enables hostname verification, while retaining an explicitly named | development-only no-verification helper. This issue is fixed in | version 5.33.0. CVE-2026-63337[3]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives | a javaReturnType value in an untrusted system.describe response and | passes it through JSONUtil.tryFill, setJavaReturnType, and | computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with | initialization enabled. An attacker able to answer the JsonRpcClient | request through a shared broker or network interception can select a | class already present in the victim JVM and trigger its static | initializer, while JsonRpcClient.java later passes getReturnType | output to mapper.parse and may also create type confusion. | Successful exploitation can affect confidentiality, integrity, and | availability in the client process. This issue is fixed in version | 5.33.0. CVE-2026-69219[4]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java | uses ValueReader.readBytes to accept a wire-declared contentLength | below Integer.MAX_VALUE and allocate a byte array before checking | the bytes available in the frame. A malicious AMQP peer can send a | LongString or byte-array field with type tag S and a declared length | such as 0x7FFFFFFE during the pre-authentication connection.start | server-properties table, causing an approximately 2 GB allocation | and OutOfMemoryError before readFully consumes data. The resulting | memory exhaustion can terminate the JVM and cause denial of service. | This issue is fixed in version 5.33.1. CVE-2026-69220[5]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java | permits ValueReader.readTable and ValueReader.readArray to call | ValueReader.readFieldValue recursively for AMQP table type F and | AMQP array type A values without a nesting-depth limit. A malicious | AMQP server or network intermediary can send approximately 580 | nested table levels in the pre-authentication connection.start | frame, fitting within the default 131072-byte frame maximum, to | trigger StackOverflowError. The error terminates the client input | processing thread and causes denial of service. This issue is fixed | in version 5.33.1. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-61634 https://www.cve.org/CVERecord?id=CVE-2026-61634 [1] https://security-tracker.debian.org/tracker/CVE-2026-63335 https://www.cve.org/CVERecord?id=CVE-2026-63335 [2] https://security-tracker.debian.org/tracker/CVE-2026-63336 https://www.cve.org/CVERecord?id=CVE-2026-63336 [3] https://security-tracker.debian.org/tracker/CVE-2026-63337 https://www.cve.org/CVERecord?id=CVE-2026-63337 [4] https://security-tracker.debian.org/tracker/CVE-2026-69219 https://www.cve.org/CVERecord?id=CVE-2026-69219 [5] https://security-tracker.debian.org/tracker/CVE-2026-69220 https://www.cve.org/CVERecord?id=CVE-2026-69220 Regards, Salvatore
