Oversized Frame Allocation in RabbitMQ Java Client Library

CVE-2026-75516

What is CVE-2026-75516?

The RabbitMQ Java client library, used for seamless communication between Java and JVM-based applications and RabbitMQ nodes, contains a vulnerability that allows attackers to exploit oversized frame allocations. When both the client default and server-negotiated frameMax values are set to zero, a potential attacker can send oversized frames that cause the client to allocate excessively large byte arrays. This flaw arises from a failure in proper content-level validation, ultimately leading to memory exhaustion and potential termination of the client process. To mitigate this risk, it is crucial to update to version 5.34.0 or later, where the issue has been addressed.

References