CVE-2026-75516: RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
- Default configuration is vulnerable: Both
requestedFrameMax(client) and legitimate servers’frameMaxin Tune may be 0 - Single-frame OOM: One malicious frame triggers up to ~2GB allocation (
Integer.MAX_VALUEbytes) - Bypasses existing protection:
maxInboundMessageBodySize(introduced to cap allocations at 64MB) is entirely defeated at the frame level - Different from ValueReader OOM: This is a frame-layer allocation in
Frame.readFrom(), not a value-layer allocation inValueReader.readBytes()
References
- github.com/advisories/GHSA-jh4v-gfqj-7rhx
- github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e
- github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763
- github.com/rabbitmq/rabbitmq-java-client/pull/2015
- github.com/rabbitmq/rabbitmq-java-client/pull/2016
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.34.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx
- nvd.nist.gov/vuln/detail/CVE-2026-75516
Code Behaviors & Features
Detect and mitigate CVE-2026-75516 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →