CVE-2026-63335

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63335
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63335.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63335
Aliases
Downstream
Related
Published
2026-08-18T16:20:08.128Z
Modified
2026-08-20T10:17:19.274307Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H CVSS Calculator
Summary
RabbitMQ Java client malformed body frame triggers raw command assembler exception
Details

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection. This issue is fixed in version 5.31.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63335.json"
}
References

Affected packages

Git / github.com/rabbitmq/rabbitmq-java-client

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-java-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
31735344d9f9dfc53740b67f06e560e8846b9322
Fixed
abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b
Fixed
8522a4f13cc16e72b6046800276b91ac973df998
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.31.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
rabbitmq_v1_4_0
rabbitmq_v1_6_0
rabbitmq_v1_7_0
rabbitmq_v1_7_1
rabbitmq_v1_7_2
rabbitmq_v1_8_0
rabbitmq_v1_8_1
rabbitmq_v2_4_0
rabbitmq_v2_7_0
rabbitmq_v3_4_1
rabbitmq_v3_4_2
rabbitmq_v3_4_3
rabbitmq_v3_4_4
rabbitmq_v3_5_0
rabbitmq_v3_6_0
rabbitmq_v3_6_0_milestone1
rabbitmq_v3_6_0_milestone2
rabbitmq_v3_6_0_milestone3
rabbitmq_v3_6_0_rc1
rabbitmq_v3_6_0_rc2
rabbitmq_v3_6_0_rc3
rabbitmq_v3_7_0_milestone1
rabbitmq_v3_7_0_milestone10
rabbitmq_v3_7_0_milestone11
rabbitmq_v3_7_0_milestone12
rabbitmq_v3_7_0_milestone13
rabbitmq_v3_7_0_milestone14
rabbitmq_v3_7_0_milestone15
rabbitmq_v3_7_0_milestone2
rabbitmq_v3_7_0_milestone3
rabbitmq_v3_7_0_milestone4
rabbitmq_v3_7_0_milestone5
rabbitmq_v3_7_0_milestone7
rabbitmq_v3_7_0_milestone8
rabbitmq_v3_7_0_milestone9
v4.*
v4.0.0
v4.0.0.M1
v4.0.0.M2
v4.0.0.RC1
v4.0.0.RC2
v4.1.0
v4.1.0.RC1
v5.*
v5.0.0
v5.0.0.RC1
v5.1.0
v5.1.0.RC1
v5.10.0
v5.10.0.RC1
v5.10.0.RC2
v5.11.0.RC1
v5.12.0
v5.12.0.RC1
v5.13.0
v5.13.0.RC1
v5.13.0.RC2
v5.14.0
v5.14.0.RC1
v5.15.0
v5.15.0.RC1
v5.16.0
v5.16.0.RC1
v5.17.0
v5.17.0.RC1
v5.17.0.RC2
v5.18.0
v5.19.0
v5.2.0
v5.2.0.RC1
v5.20.0
v5.21.0
v5.22.0
v5.23.0
v5.24.0
v5.25.0
v5.26.0
v5.27.0
v5.27.1
v5.28.0
v5.29.0
v5.30.0
v5.4.0
v5.4.0.M1
v5.4.0.RC1
v5.4.0.RC2
v5.4.0.RC3
v5.5.0
v5.5.0.RC1
v5.6.0
v5.6.0.RC1
v5.7.0
v5.7.0.RC1
v5.8.0
v5.8.0.RC1
v5.8.0.RC2
v5.9.0
v5.9.0.RC1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63335.json"
vanir_signatures 
[
    {
        "target": {
            "function": "consumeBodyFrame",
            "file": "src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-012a6345",
        "signature_version": "v1",
        "digest": {
            "length": 355.0,
            "function_hash": "113436159591811951417367023825657231429"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "flush",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-0725ed55",
        "signature_version": "v1",
        "digest": {
            "length": 53.0,
            "function_hash": "214960959352117736363137321275126662916"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-3a65dea8",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181248270685752537496174494506243749448",
                "337751065334116868919569819863579912745",
                "152878428638427469903188881369738305080",
                "5195527134982647977271254424849881584",
                "60672049507144186417430045020735499958",
                "251425953603517327689740032187669597524",
                "76852307885500334796569885795965399907"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "getTimeout",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-3c0d9651",
        "signature_version": "v1",
        "digest": {
            "length": 56.0,
            "function_hash": "72348727834186509830216413773695737903"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "setTimeout",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-5bcb9908",
        "signature_version": "v1",
        "digest": {
            "length": 57.0,
            "function_hash": "200792073593990824025799589071722481551"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-60f0fac9",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "232148879381027219220897003126917417138",
                "142003036452518149118953330572481871862",
                "158353819911897679300318292019036516962",
                "134633516600642403585069861954922435098",
                "229109649504744801587962863841693824935",
                "211122929031592181548892333488180053414",
                "297916540907492754980621624655252926119",
                "15391815244905534015482529348098159714",
                "470998443136746942916324201074704157",
                "294960558059860677450528643887470271505",
                "99415945393472714671447413117699487693",
                "312789643049701854255291743689728176224",
                "145865334032179002289299565345445248569",
                "269087596878684858746357066179547368148",
                "282547508245612674297710591547385898006"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "AMQConnection",
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-691557ab",
        "signature_version": "v1",
        "digest": {
            "length": 1643.0,
            "function_hash": "67998358074685588042680564724120455000"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "AMQConnection",
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-6fd98d6b",
        "signature_version": "v1",
        "digest": {
            "length": 1643.0,
            "function_hash": "67998358074685588042680564724120455000"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "writeFrame",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-715df9ea",
        "signature_version": "v1",
        "digest": {
            "length": 53.0,
            "function_hash": "214960959352117736363137321275126662916"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "flush",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-790cbac1",
        "signature_version": "v1",
        "digest": {
            "length": 53.0,
            "function_hash": "214960959352117736363137321275126662916"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "getTimeout",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-7bc3ac8f",
        "signature_version": "v1",
        "digest": {
            "length": 56.0,
            "function_hash": "72348727834186509830216413773695737903"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "sendHeader",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-7e37cdd4",
        "signature_version": "v1",
        "digest": {
            "length": 41.0,
            "function_hash": "250527731205310326823847224905002852805"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "readFrame",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-95aebc9b",
        "signature_version": "v1",
        "digest": {
            "length": 72.0,
            "function_hash": "142809125740039619620930187864766220635"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "sendHeader",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-a141e371",
        "signature_version": "v1",
        "digest": {
            "length": 41.0,
            "function_hash": "250527731205310326823847224905002852805"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-a505f6ea",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "41228490948656307040561663267058821858",
                "42404289314585447902634254573165453461",
                "62863027212286331622089366581331058697",
                "292958446065375349329649982485119814968",
                "234557900494186107334221789820685961416",
                "127199438705043831419933116556281128629",
                "42498308077150225533052948929062188989",
                "313773127589973056725585995842402196566",
                "218744250262028518663136411935822476502",
                "252441689990731957229778397658730244356",
                "207005914455243209513369682276535646569",
                "189268951860962848400322739293355300419",
                "200788956430344112922900978524511924218",
                "88994874315910877238767463061475073218",
                "214284301852915793365850431982684301435",
                "338819100117925500008325318157090482646",
                "190519952012664494705971125789946663691",
                "239019689226487143068371643391433707706",
                "123768989262721837661103423450745793041",
                "53189265200634329333951814358498770158",
                "220884027888050459794073188008898298494",
                "260273645378232549304332084808260053200",
                "51565164520180438402886789306522088253",
                "85832621099233603616905294929278791257",
                "212278299191245701166925696015594178698",
                "77708959523313425038615550310098791631",
                "318175364395105438490869867693133623446",
                "240459468305057491364706968600935257620",
                "220560384761239226768643432938769820823",
                "2442432983784095609245020150785359221",
                "90234184443089953268550266682612491298",
                "77262484073775728503768017863770511763",
                "126460037643823190494811850024141879592",
                "5339217228854624211342951191513563929",
                "43257458629078964320882548378025647267",
                "250939854657890676609359531851694540017",
                "111465418220120991431656924157182385380",
                "131810911509561580421692872546866256242",
                "211979980694297356912867075798473966256",
                "61830116688876719139375353234253908039",
                "298507646245192254930295912385705404710",
                "171038278989506678355359113343035132973",
                "291689015478244856610198391538506089818",
                "250573898688383339628042314461903872879",
                "255999621424998146008611909765575697449",
                "219414482875597683797909395529231968729",
                "215014637989525138427910644683840986459"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-abac37e3",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "232148879381027219220897003126917417138",
                "142003036452518149118953330572481871862",
                "158353819911897679300318292019036516962",
                "134633516600642403585069861954922435098",
                "229109649504744801587962863841693824935",
                "211122929031592181548892333488180053414",
                "297916540907492754980621624655252926119",
                "15391815244905534015482529348098159714",
                "470998443136746942916324201074704157",
                "294960558059860677450528643887470271505",
                "99415945393472714671447413117699487693",
                "312789643049701854255291743689728176224",
                "145865334032179002289299565345445248569",
                "269087596878684858746357066179547368148",
                "282547508245612674297710591547385898006"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "readFrame",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-b2bf4433",
        "signature_version": "v1",
        "digest": {
            "length": 72.0,
            "function_hash": "142809125740039619620930187864766220635"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "writeFrame",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-b5fb2cdb",
        "signature_version": "v1",
        "digest": {
            "length": 53.0,
            "function_hash": "214960959352117736363137321275126662916"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-d956d107",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "41228490948656307040561663267058821858",
                "42404289314585447902634254573165453461",
                "62863027212286331622089366581331058697",
                "292958446065375349329649982485119814968",
                "234557900494186107334221789820685961416",
                "127199438705043831419933116556281128629",
                "42498308077150225533052948929062188989",
                "313773127589973056725585995842402196566",
                "218744250262028518663136411935822476502",
                "252441689990731957229778397658730244356",
                "207005914455243209513369682276535646569",
                "189268951860962848400322739293355300419",
                "200788956430344112922900978524511924218",
                "88994874315910877238767463061475073218",
                "214284301852915793365850431982684301435",
                "338819100117925500008325318157090482646",
                "190519952012664494705971125789946663691",
                "239019689226487143068371643391433707706",
                "123768989262721837661103423450745793041",
                "53189265200634329333951814358498770158",
                "220884027888050459794073188008898298494",
                "260273645378232549304332084808260053200",
                "51565164520180438402886789306522088253",
                "85832621099233603616905294929278791257",
                "212278299191245701166925696015594178698",
                "77708959523313425038615550310098791631",
                "318175364395105438490869867693133623446",
                "240459468305057491364706968600935257620",
                "220560384761239226768643432938769820823",
                "2442432983784095609245020150785359221",
                "90234184443089953268550266682612491298",
                "77262484073775728503768017863770511763",
                "126460037643823190494811850024141879592",
                "5339217228854624211342951191513563929",
                "43257458629078964320882548378025647267",
                "250939854657890676609359531851694540017",
                "111465418220120991431656924157182385380",
                "131810911509561580421692872546866256242",
                "211979980694297356912867075798473966256",
                "61830116688876719139375353234253908039",
                "298507646245192254930295912385705404710",
                "171038278989506678355359113343035132973",
                "291689015478244856610198391538506089818",
                "250573898688383339628042314461903872879",
                "255999621424998146008611909765575697449",
                "219414482875597683797909395529231968729",
                "215014637989525138427910644683840986459"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322",
        "id": "CVE-2026-63335-e6c2ab24",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "181248270685752537496174494506243749448",
                "337751065334116868919569819863579912745",
                "152878428638427469903188881369738305080",
                "5195527134982647977271254424849881584",
                "60672049507144186417430045020735499958",
                "251425953603517327689740032187669597524",
                "76852307885500334796569885795965399907"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "consumeBodyFrame",
            "file": "src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-f6667b3e",
        "signature_version": "v1",
        "digest": {
            "length": 355.0,
            "function_hash": "113436159591811951417367023825657231429"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "setTimeout",
            "file": "src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b",
        "id": "CVE-2026-63335-fa5081f5",
        "signature_version": "v1",
        "digest": {
            "length": 57.0,
            "function_hash": "200792073593990824025799589071722481551"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-20T10:17:19Z"