CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
References
- github.com/advisories/GHSA-93j5-89vc-pph4
- github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0
- github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc
- github.com/rabbitmq/rabbitmq-java-client/pull/2007
- github.com/rabbitmq/rabbitmq-java-client/pull/2008
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4
- nvd.nist.gov/vuln/detail/CVE-2026-69220
Code Behaviors & Features
Detect and mitigate CVE-2026-69220 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →