Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rabbitmq | rabbitmq-java-client | < 5.18.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | rabbitmq-java-client | No fix yet | — |
| Debian 12 | rabbitmq-java-client | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rabbitmq-java-client | No fix yet | — |
| Ubuntu 26.04 LTS | rabbitmq-java-client | No fix yet | — |
| Ubuntu 25.10 | rabbitmq-java-client | No fix yet | — |
| Ubuntu 24.04 LTS | rabbitmq-java-client | No fix yet | — |
| Ubuntu 22.04 LTS | rabbitmq-java-client | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | rabbitmq-java-client | No fix yet | — |
| Ubuntu 18.04 LTS | rabbitmq-java-client | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cassandra-reaper | 4.0.1-r1 | — |
| Wolfi rolling | trino | 478-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.rabbitmq:amqp-client | < 5.18.0 | 5.18.0 | GHSA-mm8h-8587-p46h |
Advisories 6
- NCSC-2024-0332 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Aug 13, 2024
- ICSA-24-228-06 Siemens SINEC NMS CISA ICS & IT advisories · Aug 13, 2024
- SSA-784301 SSA-784301: Multiple Vulnerabilities in SINEC NMS Before V3.0 Siemens ProductCERT · Aug 13, 2024
- WID-SEC-2023-2727 RabbitMQ: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 5, 2024
- ICSA-24-046-15 Siemens SINEC NMS CISA ICS & IT advisories · Mar 12, 2024
- SSA-943925 SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 Siemens ProductCERT · Mar 12, 2024
References
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
- https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
- https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0