CVE-2026-75516: RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
- Default configuration is vulnerable: Both
requestedFrameMax(client) and legitimate servers’frameMaxin Tune may be 0 - Single-frame OOM: One malicious frame triggers up to ~2GB allocation (
Integer.MAX_VALUEbytes) - Bypasses existing protection:
maxInboundMessageBodySize(introduced to cap allocations at 64MB) is entirely defeated at the frame level - Different from ValueReader OOM: This is a frame-layer allocation in
Frame.readFrom(), not a value-layer allocation inValueReader.readBytes()
References
- github.com/advisories/GHSA-jh4v-gfqj-7rhx
- github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e
- github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763
- github.com/rabbitmq/rabbitmq-java-client/pull/2015
- github.com/rabbitmq/rabbitmq-java-client/pull/2016
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.34.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx
- nvd.nist.gov/vuln/detail/CVE-2026-75516
Code Behaviors & Features
Detect and mitigate CVE-2026-75516 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →