What’s Vulnerable › Vulnerabilities

CVE-2023-46120: RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-24 · updated 2026-06-17
• Weakness: CWE-400

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

Affected products

• rabbitmq-java-client: before 5.18.0 — fixed in 5.18.0
• Rabbitmq-Java-Client: before 5.18.0 — fixed in 5.18.0
• rabbitmq-java-client: before 5.18.0

How to fix

Upgrade to a fixed version: rabbitmq-java-client 5.18.0; Rabbitmq-Java-Client 5.18.0. Check the vendor advisory for mitigations.

References

• https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
• https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
• https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
• https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
• https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
• https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h

Get alerted when CVE-2023-46120 or the next vulnerability affects your stack