CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception
RabbitMQ Java Client’s inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw UnsupportedOperationException from CommandAssembler. A broker peer that the client has connected to can use this malformed frame sequence to fail frame processing and tear down the client connection instead of receiving a clean protocol-level malformed-frame error.
This was discovered based on an existing vulnerability CVE-2017-15699.
References
- github.com/advisories/GHSA-qx7j-jv8m-fppr
- github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322
- github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b
- github.com/rabbitmq/rabbitmq-java-client/pull/1959
- github.com/rabbitmq/rabbitmq-java-client/pull/1960
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr
- nvd.nist.gov/vuln/detail/CVE-2026-63335
Code Behaviors & Features
Detect and mitigate CVE-2026-63335 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →