{"id":"CVE-2026-61634","summary":"RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with MalformedFrameException. The protocol violation can disrupt the affected connection and cause client-side denial of service. This issue is fixed in version 5.33.0.","aliases":["GHSA-5xwg-cfvj-gff5"],"modified":"2026-08-20T10:17:17.986820Z","published":"2026-08-18T16:32:19.602Z","related":["CGA-8rr9-62hv-h636"],"database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61634.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61634.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5xwg-cfvj-gff5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61634"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1994"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1995"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"08790f09686173eb17b48d08a25edcb32e71a591"},{"fixed":"b491075f42e89967610c40beded68d3680cfd472"},{"fixed":"a6ff07ecf96c1f001d611ea9b88ed8b6e045aa61"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.33.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61634.json","vanir_signatures_modified":"2026-08-20T10:17:17Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"},"deprecated":false,"digest":{"line_hashes":["29776808060934731200201931493722276864","157806805022944321802421940977293455115","80452453490343436212161862645944662000"],"threshold":0.9},"id":"CVE-2026-61634-0e5c0a8b"},{"deprecated":false,"digest":{"line_hashes":["190928764492015454107891136516473032082","269648409593937361268746649589612617630","40695829026856543265240390882335139316","271990159300175902262638733235789818198","179291745350089658903299406352631379262","26042973755215439762418524504838465446","218880872344096593558894150315970885464"],"threshold":0.9},"id":"CVE-2026-61634-160815b9","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","target":{"file":"src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["29776808060934731200201931493722276864","157806805022944321802421940977293455115","80452453490343436212161862645944662000"]},"id":"CVE-2026-61634-668ead69","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"}},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","target":{"file":"src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java"},"deprecated":false,"digest":{"line_hashes":["7364690302261734102967496031917630628","132283502741885140418525070527976370884","127523576502429203061785181547424056639","208180552232246077349218791124379685188","191848233339757114268547572160042636935","218196249718693080165070563108111529528","8638073533944866788679453264900490970"],"threshold":0.9},"id":"CVE-2026-61634-74b6138d","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["178176693095931306470684237599297590173","47267406555663162483469558700829157781","65031191002986344572522130251736320964"],"threshold":0.9},"id":"CVE-2026-61634-c46ac01d","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","target":{"file":"src/main/java/com/rabbitmq/client/impl/FrameHandler.java"}},{"deprecated":false,"digest":{"function_hash":"336068886279777151848157528557000479145","length":4659},"id":"CVE-2026-61634-d0839177","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591","target":{"function":"start","file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472","target":{"function":"start","file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"},"deprecated":false,"digest":{"function_hash":"41876736697945474765532777898340874029","length":4842},"id":"CVE-2026-61634-d0e3c30d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591","target":{"file":"src/main/java/com/rabbitmq/client/impl/FrameHandler.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["178176693095931306470684237599297590173","47267406555663162483469558700829157781","65031191002986344572522130251736320964"]},"id":"CVE-2026-61634-fd363e1f"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["7364690302261734102967496031917630628","132283502741885140418525070527976370884","127523576502429203061785181547424056639","208180552232246077349218791124379685188","191848233339757114268547572160042636935","218196249718693080165070563108111529528","8638073533944866788679453264900490970"]},"id":"CVE-2026-61634-fe215a47","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591","target":{"file":"src/main/java/com/rabbitmq/client/impl/NettyFrameHandlerFactory.java"}},{"target":{"file":"src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java"},"deprecated":false,"digest":{"line_hashes":["190928764492015454107891136516473032082","269648409593937361268746649589612617630","40695829026856543265240390882335139316","271990159300175902262638733235789818198","179291745350089658903299406352631379262","26042973755215439762418524504838465446","218880872344096593558894150315970885464"],"threshold":0.9},"id":"CVE-2026-61634-fffdb4eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"}]}