Denial of Service Vulnerability in RabbitMQ Java Client Library

CVE-2026-69220

What is CVE-2026-69220?

The RabbitMQ Java client library has a vulnerability that allows Java and JVM-based applications to connect to RabbitMQ nodes. Prior to version 5.33.1, the implementation of reading AMQP data could lead to a stack overflow when processing deeply nested tables or arrays. An attacker could exploit this flaw by sending a maliciously crafted connection.start frame with over 580 nested structures, resulting in a StackOverflowError that disrupts the client’s input processing thread, causing a denial of service. Users are advised to update to version 5.33.1 to mitigate this risk.

References