Memory Exhaustion Vulnerability in RabbitMQ Java Client Library

CVE-2026-69219

What is CVE-2026-69219?

The RabbitMQ Java client library, prior to version 5.33.1, is susceptible to a memory exhaustion issue due to improper handling of wire-declared content lengths. A malicious AMQP peer can exploit this flaw by sending a LongString or byte-array field during the connection.start server-properties table, which may lead to an allocation of approximately 2 GB of memory before verifying the available bytes. This exploitation can result in an OutOfMemoryError, terminating the Java Virtual Machine (JVM) and resulting in a denial of service. The vulnerability has been addressed in version 5.33.1.

References