HighFix available

rabbitmq-java-client security update

Type: advisorySource: OSV1 source record

The library allows Java code to interface to AMQP servers. Please see the specification page for more information on AMQP inter-operation and standards-conformance You will need an AMQP server, such as our very own RabbitMQ server, to use with the client library. Security Fix(es): The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.(CVE-2023-46120) The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with MalformedF

Announced 25 Sept 2026Group revision 1

Original source ↗

OESA-2026-4112

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:OESA-2026-4112

rabbitmq-java-client

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 3.6.5-4.oe2403sp3
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

rabbitmq-java-client

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: 3.6.5-4.oe2403sp4
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

rabbitmq-java-client

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: 3.6.5-2.oe2003sp4
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

rabbitmq-java-client

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: 3.6.5-4.oe2203sp4
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

rabbitmq-java-client

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: 3.6.5-4.oe2403sp1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.6.5-4.oe2403sp3"
          }
        ]
      }
    ],
    "package": {
      "name": "rabbitmq-java-client",
      "purl": "pkg:rpm/openEuler/rabbitmq-java-client&distro=openEuler-24.03-LTS-SP3",
      "ecosystem": "openEuler:24.03-LTS-SP3"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4112.json"
    },
    "ecosystem_specific": {
      "src": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp3.src.rpm"
      ],
      "noarch": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp3.noarch.rpm",
        "rabbitmq-java-client-doc-3.6.5-4.oe2403sp3.noarch.rpm",
        "rabbitmq-java-client-javadoc-3.6.5-4.oe2403sp3.noarch.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.6.5-4.oe2403sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "rabbitmq-java-client",
      "purl": "pkg:rpm/openEuler/rabbitmq-java-client&distro=openEuler-24.03-LTS-SP4",
      "ecosystem": "openEuler:24.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4112.json"
    },
    "ecosystem_specific": {
      "src": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp4.src.rpm"
      ],
      "noarch": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp4.noarch.rpm",
        "rabbitmq-java-client-doc-3.6.5-4.oe2403sp4.noarch.rpm",
        "rabbitmq-java-client-javadoc-3.6.5-4.oe2403sp4.noarch.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.6.5-2.oe2003sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "rabbitmq-java-client",
      "purl": "pkg:rpm/openEuler/rabbitmq-java-client&distro=openEuler-20.03-LTS-SP4",
      "ecosystem": "openEuler:20.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4112.json"
    },
    "ecosystem_specific": {
      "src": [
        "rabbitmq-java-client-3.6.5-2.oe2003sp4.src.rpm"
      ],
      "noarch": [
        "rabbitmq-java-client-3.6.5-2.oe2003sp4.noarch.rpm",
        "rabbitmq-java-client-doc-3.6.5-2.oe2003sp4.noarch.rpm",
        "rabbitmq-java-client-javadoc-3.6.5-2.oe2003sp4.noarch.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.6.5-4.oe2203sp4"
          }
        ]
      }
    ],
    "package": {
      "name": "rabbitmq-java-client",
      "purl": "pkg:rpm/openEuler/rabbitmq-java-client&distro=openEuler-22.03-LTS-SP4",
      "ecosystem": "openEuler:22.03-LTS-SP4"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4112.json"
    },
    "ecosystem_specific": {
      "src": [
        "rabbitmq-java-client-3.6.5-4.oe2203sp4.src.rpm"
      ],
      "noarch": [
        "rabbitmq-java-client-3.6.5-4.oe2203sp4.noarch.rpm",
        "rabbitmq-java-client-doc-3.6.5-4.oe2203sp4.noarch.rpm",
        "rabbitmq-java-client-javadoc-3.6.5-4.oe2203sp4.noarch.rpm"
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.6.5-4.oe2403sp1"
          }
        ]
      }
    ],
    "package": {
      "name": "rabbitmq-java-client",
      "purl": "pkg:rpm/openEuler/rabbitmq-java-client&distro=openEuler-24.03-LTS-SP1",
      "ecosystem": "openEuler:24.03-LTS-SP1"
    },
    "database_specific": {
      "source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4112.json"
    },
    "ecosystem_specific": {
      "src": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp1.src.rpm"
      ],
      "noarch": [
        "rabbitmq-java-client-3.6.5-4.oe2403sp1.noarch.rpm",
        "rabbitmq-java-client-doc-3.6.5-4.oe2403sp1.noarch.rpm",
        "rabbitmq-java-client-javadoc-3.6.5-4.oe2403sp1.noarch.rpm"
      ]
    }
  }
]

Publisher severity

high

Source reference: /database_specific/severity

Event: #14768 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:47:28 GMT
Publisher date: Fri, 25 Sep 2026 01:28:35 GMT

Read the original announcement

Revision history

25 Oct 2026OESA-2026-4112 · Revision 1Source updated