Read the docs
TI-2023-24762 Aliases CVE-2023-46120GHSA-mm8h-8587-p46h

RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

Priority HIGH 66CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01336 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed rabbitmq-java-client (rabbitmq): 5.18.0com.rabbitmq:amqp-client (Maven): 5.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-java-clientbefore 5.18.05.18.0Patch availableCNA
—com.rabbitmq:amqp-client (Maven)before 5.18.05.18.0Patch availableGHSA-mm8h-8587-p46h
  • rabbitmq-java-client Vendorrabbitmq Affected before 5.18.0 Fixed in 5.18.0 Patch available CNA
  • com.rabbitmq:amqp-client (Maven) Vendor— Affected before 5.18.0 Fixed in 5.18.0 Patch available GHSA-mm8h-8587-p46h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*before 5.18.0VulnerableVMware
  • cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:* Versions before 5.18.0 Vulnerable ·VMware

Remediation

  • Fix · CNA rabbitmq-java-client (rabbitmq) Fixed in 5.18.0
  • Fix · GHSA-mm8h-8587-p46h com.rabbitmq:amqp-client (Maven) Fixed in 5.18.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46120
  2. 2026-10-03 Alias added: GHSA-mm8h-8587-p46h

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences