MEDIUM GitHub
CVE-2026-63335
RabbitMQ Java client malformed body frame triggers raw command assembler exception
### Summary
RabbitMQ Java Client's inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw `UnsupportedOperationException` from `CommandAssembler`. A broker peer that the client has connected to can use this malformed frame sequence to fail frame processing and tear down the client connection instead of receiving a clean protocol-level malformed-frame error.
This was discovered based on an existing vulnerability CVE
Affected Products
- maven/com.rabbitmq:amqp-client <= 5.30.0
References
- https://github.com/advisories/GHSA-qx7j-jv8m-fppr
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr
- https://github.com/rabbitmq/rabbitmq-java-client/pull/1959
- https://github.com/rabbitmq/rabbitmq-java-client/pull/1960
This medium severity vulnerability was published on 2026-08-18 via GitHub. Affected: maven/com.rabbitmq:amqp-client <= 5.30.0.
vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.