CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception
RabbitMQ Java Client’s inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw UnsupportedOperationException from CommandAssembler. A broker peer that the client has connected to can use this malformed frame sequence to fail frame processing and tear down the client connection instead of receiving a clean protocol-level malformed-frame error.
This was discovered based on an existing vulnerability CVE-2017-15699.
References
- github.com/advisories/GHSA-qx7j-jv8m-fppr
- github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322
- github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b
- github.com/rabbitmq/rabbitmq-java-client/pull/1959
- github.com/rabbitmq/rabbitmq-java-client/pull/1960
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr
- nvd.nist.gov/vuln/detail/CVE-2026-63335
Code Behaviors & Features
Detect and mitigate CVE-2026-63335 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →