HIGH GitHub
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
## Summary
`ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.
## Vulnerable Code
`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95:
```java
private static byte[] readBytes(final DataInputStream in) throws IOException {
final long contentLength = unsignedExtend(in.readInt());
if(contentLength < Integer.MAX
Affected Products
- maven/com.rabbitmq:amqp-client <= 5.33.0
References
- https://github.com/advisories/GHSA-68mj-5wr7-6fgg
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2007
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2008
This high severity vulnerability was published on 2026-08-18 via GitHub. Affected: maven/com.rabbitmq:amqp-client <= 5.33.0.
vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.