CVE-2026-75516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-75516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-75516
Aliases
Downstream
Published
2026-09-16T18:30:58Z
Modified
2026-09-18T08:11:04Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Details

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75516.json"
}
References

Affected packages

Git / github.com/rabbitmq/rabbitmq-java-client

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-java-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d7c2bfe89796ca34d3531098fb59dd657fea39e
Fixed
e7f10bf99aee103dd9f64b3e52a725fc9f9d3763
Fixed
877cf12fff9f6820cd59be120e52ea641c55ee07
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.34.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
rabbitmq_v1_4_0
rabbitmq_v1_6_0
rabbitmq_v1_7_0
rabbitmq_v1_7_1
rabbitmq_v1_7_2
rabbitmq_v1_8_0
rabbitmq_v1_8_1
rabbitmq_v2_4_0
rabbitmq_v2_7_0
rabbitmq_v3_4_1
rabbitmq_v3_4_2
rabbitmq_v3_4_3
rabbitmq_v3_4_4
rabbitmq_v3_5_0
rabbitmq_v3_6_0
rabbitmq_v3_6_0_milestone1
rabbitmq_v3_6_0_milestone2
rabbitmq_v3_6_0_milestone3
rabbitmq_v3_6_0_rc1
rabbitmq_v3_6_0_rc2
rabbitmq_v3_6_0_rc3
rabbitmq_v3_7_0_milestone1
rabbitmq_v3_7_0_milestone10
rabbitmq_v3_7_0_milestone11
rabbitmq_v3_7_0_milestone12
rabbitmq_v3_7_0_milestone13
rabbitmq_v3_7_0_milestone14
rabbitmq_v3_7_0_milestone15
rabbitmq_v3_7_0_milestone2
rabbitmq_v3_7_0_milestone3
rabbitmq_v3_7_0_milestone4
rabbitmq_v3_7_0_milestone5
rabbitmq_v3_7_0_milestone7
rabbitmq_v3_7_0_milestone8
rabbitmq_v3_7_0_milestone9
v4.*
v4.0.0
v4.0.0.M1
v4.0.0.M2
v4.0.0.RC1
v4.0.0.RC2
v4.1.0
v4.1.0.RC1
v5.*
v5.0.0
v5.0.0.RC1
v5.1.0
v5.1.0.RC1
v5.10.0
v5.10.0.RC1
v5.10.0.RC2
v5.11.0.RC1
v5.12.0
v5.12.0.RC1
v5.13.0
v5.13.0.RC1
v5.13.0.RC2
v5.14.0
v5.14.0.RC1
v5.15.0
v5.15.0.RC1
v5.16.0
v5.16.0.RC1
v5.17.0
v5.17.0.RC1
v5.17.0.RC2
v5.18.0
v5.19.0
v5.2.0
v5.2.0.RC1
v5.20.0
v5.21.0
v5.22.0
v5.23.0
v5.24.0
v5.25.0
v5.26.0
v5.27.0
v5.27.1
v5.28.0
v5.29.0
v5.30.0
v5.31.0
v5.32.0
v5.33.0
v5.33.1
v5.4.0
v5.4.0.M1
v5.4.0.RC1
v5.4.0.RC2
v5.4.0.RC3
v5.5.0
v5.5.0.RC1
v5.6.0
v5.6.0.RC1
v5.7.0
v5.7.0.RC1
v5.8.0
v5.8.0.RC1
v5.8.0.RC2
v5.9.0
v5.9.0.RC1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75516.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146115124314126182949900184635886249999",
                "98548658084644824350634238081337281692",
                "284747455003740954311204232345897003961"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-2063aaf4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/Utils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231758711938626930161656387102452146297",
            "length": 4754
        },
        "id": "CVE-2026-75516-3576eb77",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java",
            "function": "start"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "21092444307686542001675770667578003325",
            "length": 4937
        },
        "id": "CVE-2026-75516-40d38982",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java",
            "function": "start"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264394281488254159082755763722812024784",
                "131477970202380747749503991993219563786",
                "214671423437859322822449329154781818603",
                "41179401767495262825830271817421513474"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-7af55d56",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57369000957106433458313584012894140969",
                "28535493832223386281257255236624863339",
                "129401506477667999653009050827613136984",
                "267230416918429395461884955404531702049"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-87c0f6d1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763",
        "target": {
            "file": "src/test/java/com/rabbitmq/client/test/ClientTestSuite.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264394281488254159082755763722812024784",
                "131477970202380747749503991993219563786",
                "214671423437859322822449329154781818603",
                "41179401767495262825830271817421513474"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-91b71133",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/AMQConnection.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57369000957106433458313584012894140969",
                "28535493832223386281257255236624863339",
                "129401506477667999653009050827613136984",
                "267230416918429395461884955404531702049"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-a05f284d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e",
        "target": {
            "file": "src/test/java/com/rabbitmq/client/test/ClientTestSuite.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146115124314126182949900184635886249999",
                "98548658084644824350634238081337281692",
                "284747455003740954311204232345897003961"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75516-ee659d30",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763",
        "target": {
            "file": "src/main/java/com/rabbitmq/client/impl/Utils.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-18T08:11:04Z"