CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
References
- github.com/advisories/GHSA-93j5-89vc-pph4
- github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0
- github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc
- github.com/rabbitmq/rabbitmq-java-client/pull/2007
- github.com/rabbitmq/rabbitmq-java-client/pull/2008
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4
- nvd.nist.gov/vuln/detail/CVE-2026-69220
Code Behaviors & Features
Detect and mitigate CVE-2026-69220 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →