HIGH GitHub
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
## Summary
`ValueReader.readTable()` and `readArray()` recursively call `readFieldValue()` with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
## Vulnerable Code
`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 139-155 and 237-249:
```java
private static Map<String, Object> readTable(DataInputStream in) throws IOException {
long tableLength = unsignedExtend(in.readInt());
// ...
while(tableIn.available() >
Affected Products
- maven/com.rabbitmq:amqp-client <= 5.33.0
References
- https://github.com/advisories/GHSA-93j5-89vc-pph4
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2007
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2008
This high severity vulnerability was published on 2026-08-18 via GitHub. Affected: maven/com.rabbitmq:amqp-client <= 5.33.0.
vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.