CVE-2026-75516

The record

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.

Affected packages

Related vulnerabilities

• CVE-2026-64847 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-770
• CVE-2026-77403 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-770
• CVE-2026-80225 In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability… CWE-770
• CVE-2026-50270 dd-trace-java is a Datadog APM client for Java. CWE-770
• CVE-2026-50276 dd-trace-rb is Datadog's client library for Ruby. CWE-770
• CVE-2026-78662 Previously, a channel registered in the mux's chanList is not usable until it is… CWE-770
• CVE-2026-56855 Previously, after a channel has been established, a malicious peer could send crafted… CWE-770
• CVE-2026-80212 An issue was discovered in the resolv gem before 0.7.2 for Ruby. CWE-770