{"id":"CVE-2026-69219","summary":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.","aliases":["GHSA-68mj-5wr7-6fgg"],"modified":"2026-08-21T08:19:17.609408Z","published":"2026-08-18T16:23:32.097Z","related":["CGA-r59f-82qj-j848"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-789"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69219.json"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69219.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69219"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2007"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2008"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"388209356c6478088efce4d8a07b68e73837a7a0"},{"fixed":"6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2"},{"fixed":"6ada599eda88a066bb5465f314cc9a1a55d735c3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.33.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.33.0","v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-69219-1680e39a","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2","target":{"function":"readBytes","file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false,"digest":{"function_hash":"194384705960392260563812464659158765700","length":336}},{"deprecated":false,"digest":{"function_hash":"216422269397816527590657311883425650029","length":169},"id":"CVE-2026-69219-1b3b1558","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readShortstr"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2","target":{"file":"src/test/java/com/rabbitmq/client/test/ClientTestSuite.java"},"deprecated":false,"digest":{"line_hashes":["84942648562641298183497078177199293182","111590835652771419625837368123556157757","76005705455355187770929401641020516244","172764210809827052924843598750154189857"],"threshold":0.9},"id":"CVE-2026-69219-1e1b3d5d"},{"target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false,"digest":{"line_hashes":["31047127462226029707303254373240740310","80125731969121583140105957951777284693","248792363194821411907006305339276152124","208442283104400606284446408604151654593","35597354844059794846944947842314243342","137337329222969848403640992792730140060","273725644852147916842360315001445315973","135564979382430324917875033645902052072","47572866895423637863021424486736663394","140283839282692510890373552192853339673","154141372314365669844570693106955050229","214203553721217499121259953714036455644","158772683595648117068578942774186634740","84014887891694709538810132832925126776","30628012361888668883482240812894482491","140340818221037850732458327344622830220","299884788398079544974534036693663015744","142200953305754660209918820465782608263","176343239194432819614489094388666009287"],"threshold":0.9},"id":"CVE-2026-69219-30bfdebb","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2"},{"deprecated":false,"digest":{"line_hashes":["248262900157456076503883642988775148611","94730120523653778603793645252663153903","66431959175778499984871521161097802844","172764210809827052924843598750154189857"],"threshold":0.9},"id":"CVE-2026-69219-8e1fba1a","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0","target":{"file":"src/test/java/com/rabbitmq/client/test/ClientTestSuite.java"}},{"digest":{"length":169,"function_hash":"216422269397816527590657311883425650029"},"id":"CVE-2026-69219-e4626043","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readShortstr"},"deprecated":false},{"digest":{"function_hash":"194384705960392260563812464659158765700","length":336},"id":"CVE-2026-69219-fb8570cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0","target":{"function":"readBytes","file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false},{"id":"CVE-2026-69219-fc4b639f","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["31047127462226029707303254373240740310","80125731969121583140105957951777284693","248792363194821411907006305339276152124","208442283104400606284446408604151654593","35597354844059794846944947842314243342","137337329222969848403640992792730140060","273725644852147916842360315001445315973","135564979382430324917875033645902052072","47572866895423637863021424486736663394","140283839282692510890373552192853339673","154141372314365669844570693106955050229","214203553721217499121259953714036455644","158772683595648117068578942774186634740","84014887891694709538810132832925126776","30628012361888668883482240812894482491","140340818221037850732458327344622830220","299884788398079544974534036693663015744","142200953305754660209918820465782608263","176343239194432819614489094388666009287"]}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69219.json","vanir_signatures_modified":"2026-08-21T08:19:17Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}