{"id":"CVE-2026-63335","summary":"RabbitMQ Java client malformed body frame triggers raw command assembler exception","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection. This issue is fixed in version 5.31.0.","aliases":["GHSA-qx7j-jv8m-fppr"],"modified":"2026-08-20T10:17:19.274307Z","published":"2026-08-18T16:20:08.128Z","related":["CGA-j3vx-rxjh-78vm"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63335.json"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63335.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63335"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1959"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1960"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"31735344d9f9dfc53740b67f06e560e8846b9322"},{"fixed":"abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b"},{"fixed":"8522a4f13cc16e72b6046800276b91ac973df998"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.31.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures_modified":"2026-08-20T10:17:19Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"function":"consumeBodyFrame","file":"src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"},"deprecated":false,"digest":{"function_hash":"113436159591811951417367023825657231429","length":355},"id":"CVE-2026-63335-012a6345"},{"id":"CVE-2026-63335-0725ed55","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"function":"flush","file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"},"deprecated":false,"digest":{"function_hash":"214960959352117736363137321275126662916","length":53}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"},"deprecated":false,"digest":{"line_hashes":["181248270685752537496174494506243749448","337751065334116868919569819863579912745","152878428638427469903188881369738305080","5195527134982647977271254424849881584","60672049507144186417430045020735499958","251425953603517327689740032187669597524","76852307885500334796569885795965399907"],"threshold":0.9},"id":"CVE-2026-63335-3a65dea8"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"getTimeout"},"deprecated":false,"digest":{"function_hash":"72348727834186509830216413773695737903","length":56},"id":"CVE-2026-63335-3c0d9651","signature_type":"Function"},{"target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"setTimeout"},"deprecated":false,"digest":{"function_hash":"200792073593990824025799589071722481551","length":57},"id":"CVE-2026-63335-5bcb9908","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322"},{"digest":{"threshold":0.9,"line_hashes":["232148879381027219220897003126917417138","142003036452518149118953330572481871862","158353819911897679300318292019036516962","134633516600642403585069861954922435098","229109649504744801587962863841693824935","211122929031592181548892333488180053414","297916540907492754980621624655252926119","15391815244905534015482529348098159714","470998443136746942916324201074704157","294960558059860677450528643887470271505","99415945393472714671447413117699487693","312789643049701854255291743689728176224","145865334032179002289299565345445248569","269087596878684858746357066179547368148","282547508245612674297710591547385898006"]},"id":"CVE-2026-63335-60f0fac9","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"},"deprecated":false},{"digest":{"function_hash":"67998358074685588042680564724120455000","length":1643},"id":"CVE-2026-63335-691557ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java","function":"AMQConnection"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"67998358074685588042680564724120455000","length":1643},"id":"CVE-2026-63335-6fd98d6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java","function":"AMQConnection"}},{"id":"CVE-2026-63335-715df9ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"writeFrame"},"deprecated":false,"digest":{"function_hash":"214960959352117736363137321275126662916","length":53}},{"deprecated":false,"digest":{"function_hash":"214960959352117736363137321275126662916","length":53},"id":"CVE-2026-63335-790cbac1","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"flush"}},{"target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"getTimeout"},"deprecated":false,"digest":{"function_hash":"72348727834186509830216413773695737903","length":56},"id":"CVE-2026-63335-7bc3ac8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b"},{"id":"CVE-2026-63335-7e37cdd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"sendHeader"},"deprecated":false,"digest":{"function_hash":"250527731205310326823847224905002852805","length":41}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"readFrame"},"deprecated":false,"digest":{"function_hash":"142809125740039619620930187864766220635","length":72},"id":"CVE-2026-63335-95aebc9b","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"sendHeader"},"deprecated":false,"digest":{"function_hash":"250527731205310326823847224905002852805","length":41},"id":"CVE-2026-63335-a141e371","signature_type":"Function"},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"},"deprecated":false,"digest":{"line_hashes":["41228490948656307040561663267058821858","42404289314585447902634254573165453461","62863027212286331622089366581331058697","292958446065375349329649982485119814968","234557900494186107334221789820685961416","127199438705043831419933116556281128629","42498308077150225533052948929062188989","313773127589973056725585995842402196566","218744250262028518663136411935822476502","252441689990731957229778397658730244356","207005914455243209513369682276535646569","189268951860962848400322739293355300419","200788956430344112922900978524511924218","88994874315910877238767463061475073218","214284301852915793365850431982684301435","338819100117925500008325318157090482646","190519952012664494705971125789946663691","239019689226487143068371643391433707706","123768989262721837661103423450745793041","53189265200634329333951814358498770158","220884027888050459794073188008898298494","260273645378232549304332084808260053200","51565164520180438402886789306522088253","85832621099233603616905294929278791257","212278299191245701166925696015594178698","77708959523313425038615550310098791631","318175364395105438490869867693133623446","240459468305057491364706968600935257620","220560384761239226768643432938769820823","2442432983784095609245020150785359221","90234184443089953268550266682612491298","77262484073775728503768017863770511763","126460037643823190494811850024141879592","5339217228854624211342951191513563929","43257458629078964320882548378025647267","250939854657890676609359531851694540017","111465418220120991431656924157182385380","131810911509561580421692872546866256242","211979980694297356912867075798473966256","61830116688876719139375353234253908039","298507646245192254930295912385705404710","171038278989506678355359113343035132973","291689015478244856610198391538506089818","250573898688383339628042314461903872879","255999621424998146008611909765575697449","219414482875597683797909395529231968729","215014637989525138427910644683840986459"],"threshold":0.9},"id":"CVE-2026-63335-a505f6ea","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-63335-abac37e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/main/java/com/rabbitmq/client/impl/CommandAssembler.java"},"deprecated":false,"digest":{"line_hashes":["232148879381027219220897003126917417138","142003036452518149118953330572481871862","158353819911897679300318292019036516962","134633516600642403585069861954922435098","229109649504744801587962863841693824935","211122929031592181548892333488180053414","297916540907492754980621624655252926119","15391815244905534015482529348098159714","470998443136746942916324201074704157","294960558059860677450528643887470271505","99415945393472714671447413117699487693","312789643049701854255291743689728176224","145865334032179002289299565345445248569","269087596878684858746357066179547368148","282547508245612674297710591547385898006"],"threshold":0.9}},{"id":"CVE-2026-63335-b2bf4433","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java","function":"readFrame"},"deprecated":false,"digest":{"function_hash":"142809125740039619620930187864766220635","length":72}},{"id":"CVE-2026-63335-b5fb2cdb","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"function":"writeFrame","file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"},"deprecated":false,"digest":{"function_hash":"214960959352117736363137321275126662916","length":53}},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"},"deprecated":false,"digest":{"line_hashes":["41228490948656307040561663267058821858","42404289314585447902634254573165453461","62863027212286331622089366581331058697","292958446065375349329649982485119814968","234557900494186107334221789820685961416","127199438705043831419933116556281128629","42498308077150225533052948929062188989","313773127589973056725585995842402196566","218744250262028518663136411935822476502","252441689990731957229778397658730244356","207005914455243209513369682276535646569","189268951860962848400322739293355300419","200788956430344112922900978524511924218","88994874315910877238767463061475073218","214284301852915793365850431982684301435","338819100117925500008325318157090482646","190519952012664494705971125789946663691","239019689226487143068371643391433707706","123768989262721837661103423450745793041","53189265200634329333951814358498770158","220884027888050459794073188008898298494","260273645378232549304332084808260053200","51565164520180438402886789306522088253","85832621099233603616905294929278791257","212278299191245701166925696015594178698","77708959523313425038615550310098791631","318175364395105438490869867693133623446","240459468305057491364706968600935257620","220560384761239226768643432938769820823","2442432983784095609245020150785359221","90234184443089953268550266682612491298","77262484073775728503768017863770511763","126460037643823190494811850024141879592","5339217228854624211342951191513563929","43257458629078964320882548378025647267","250939854657890676609359531851694540017","111465418220120991431656924157182385380","131810911509561580421692872546866256242","211979980694297356912867075798473966256","61830116688876719139375353234253908039","298507646245192254930295912385705404710","171038278989506678355359113343035132973","291689015478244856610198391538506089818","250573898688383339628042314461903872879","255999621424998146008611909765575697449","219414482875597683797909395529231968729","215014637989525138427910644683840986459"],"threshold":0.9},"id":"CVE-2026-63335-d956d107","signature_type":"Line"},{"digest":{"line_hashes":["181248270685752537496174494506243749448","337751065334116868919569819863579912745","152878428638427469903188881369738305080","5195527134982647977271254424849881584","60672049507144186417430045020735499958","251425953603517327689740032187669597524","76852307885500334796569885795965399907"],"threshold":0.9},"id":"CVE-2026-63335-e6c2ab24","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322","target":{"file":"src/main/java/com/rabbitmq/client/impl/AMQConnection.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"file":"src/main/java/com/rabbitmq/client/impl/CommandAssembler.java","function":"consumeBodyFrame"},"deprecated":false,"digest":{"function_hash":"113436159591811951417367023825657231429","length":355},"id":"CVE-2026-63335-f6667b3e"},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b","target":{"function":"setTimeout","file":"src/test/java/com/rabbitmq/client/test/BrokenFramesTest.java"},"deprecated":false,"digest":{"function_hash":"200792073593990824025799589071722481551","length":57},"id":"CVE-2026-63335-fa5081f5","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63335.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H"}]}