{ "affected": [ { "database_specific": { "last_known_affected_version_range": "<= 5.33.0", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-93j5-89vc-pph4/GHSA-93j5-89vc-pph4.json" }, "package": { "ecosystem": "Maven", "name": "com.rabbitmq:amqp-client", "purl": "pkg:maven/com.rabbitmq/amqp-client" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "5.33.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "1.3.0", "1.5.4", "1.5.5", "1.6.0", "1.7.2", "1.8.0", "1.8.1", "2.0.0", "2.1.0", "2.1.1", "2.2.0", "2.3.0", "2.3.1", "2.4.1", "2.5.0", "2.5.1", "2.6.0", "2.6.1", "2.7.0", "2.7.1", "2.8.0", "2.8.1", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.1.0", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.2.0", "3.2.1", "3.2.2", "3.2.3", "3.2.4", "3.3.0", "3.3.1", "3.3.2", "3.3.3", "3.3.4", "3.3.5", "3.4.0", "3.4.1", "3.4.2", "3.4.3", "3.4.4", "3.5.0", "3.5.1", "3.5.2", "3.5.3", "3.5.4", "3.5.5", "3.5.6", "3.5.7", "3.6.0", "3.6.1", "3.6.2", "3.6.3", "3.6.4", "3.6.5", "3.6.6", "4.0.0", "4.0.1", "4.0.2", "4.0.3", "4.1.0", "4.1.1", "4.10.0", "4.11.0", "4.11.1", "4.11.2", "4.11.3", "4.12.0", "4.2.0", "4.2.1", "4.2.2", "4.3.0", "4.4.0", "4.4.1", "4.4.2", "4.5.0", "4.6.0", "4.7.0", "4.8.0", "4.8.1", "4.8.2", "4.8.3", "4.9.0", "4.9.1", "4.9.2", "4.9.3", "5.0.0", "5.1.0", "5.1.1", "5.1.2", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.13.1", "5.14.0", "5.14.1", "5.14.2", "5.14.3", "5.15.0", "5.16.0", "5.16.1", "5.17.0", "5.17.1", "5.18.0", "5.19.0", "5.2.0", "5.20.0", "5.21.0", "5.22.0", "5.23.0", "5.24.0", "5.25.0", "5.26.0", "5.27.0", "5.27.1", "5.28.0", "5.29.0", "5.3.0", "5.30.0", "5.31.0", "5.32.0", "5.33.0", "5.4.0", "5.4.1", "5.4.2", "5.4.3", "5.5.0", "5.5.1", "5.5.2", "5.5.3", "5.6.0", "5.7.0", "5.7.1", "5.7.2", "5.7.3", "5.8.0", "5.9.0" ] } ], "aliases": [ "CVE-2026-69220" ], "database_specific": { "cwe_ids": [ "CWE-674" ], "github_reviewed": true, "github_reviewed_at": "2026-08-18T16:32:12Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "## Summary\n\n`ValueReader.readTable()` and `readArray()` recursively call `readFieldValue()` with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.\n\n## Vulnerable Code\n\n`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 139-155 and 237-249:\n\n```java\nprivate static Map readTable(DataInputStream in) throws IOException {\n long tableLength = unsignedExtend(in.readInt());\n // ...\n while(tableIn.available() > 0) {\n String name = readShortstr(tableIn);\n Object value = readFieldValue(tableIn); // recursive call\n }\n}\n\nstatic Object readFieldValue(DataInputStream in) throws IOException {\n switch(in.readUnsignedByte()) {\n case 'F': value = readTable(in); // mutual recursion\n case 'A': value = readArray(in); // mutual recursion\n }\n}\n```\n\n## Attack Scenario\n\nA malicious AMQP server (or MitM) sends a `connection.start` frame with ~580 levels of nested tables. Each level costs ~7 bytes (4-byte length + 1-byte key length + 1-byte key + 1-byte type tag), totaling ~4060 bytes within the 131,072 byte max frame size. With the default JVM stack (~512KB, ~864 bytes/frame), this triggers `StackOverflowError`, killing the I/O thread.\n\nExploitable pre-authentication since `connection.start` is the very first server frame.\n\n## Impact\n\nDenial of service. `StackOverflowError` kills the client I/O thread.\n\n## CWE\n\nCWE-674: Uncontrolled Recursion\n\n## Remediation\n\nAdd a depth counter to `readTable`/`readArray`/`readFieldValue` and throw `MalformedFrameException` when exceeding a threshold (e.g., 32).", "id": "GHSA-93j5-89vc-pph4", "modified": "2026-09-10T03:51:13.771990072Z", "published": "2026-08-18T16:32:12Z", "references": [ { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4" }, { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/pull/2007" }, { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/pull/2008" }, { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0" }, { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc" }, { "type": "PACKAGE", "url": "https://github.com/rabbitmq/rabbitmq-java-client" }, { "type": "WEB", "url": "https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "type": "CVSS_V4" } ], "summary": "RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS" }