{"id":"CVE-2026-69220","summary":"RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth limit. A malicious AMQP server or network intermediary can send approximately 580 nested table levels in the pre-authentication connection.start frame, fitting within the default 131072-byte frame maximum, to trigger StackOverflowError. The error terminates the client input processing thread and causes denial of service. This issue is fixed in version 5.33.1.","aliases":["GHSA-93j5-89vc-pph4"],"modified":"2026-08-20T09:52:35.054281Z","published":"2026-08-18T16:25:16.178Z","related":["CGA-9p36-6g9x-94jq"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69220.json"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69220.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69220"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2007"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2008"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"09af76fce136f3136931654a0a1d43095c80e2f0"},{"fixed":"db89e34809fbc6ba4e946615f297f3684ccd0acc"},{"fixed":"6ada599eda88a066bb5465f314cc9a1a55d735c3"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"5.33.1"}]}}],"versions":["v5.33.0","v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readFieldValue"},"deprecated":false,"digest":{"function_hash":"2658565536881186807918581216138621940","length":1091},"id":"CVE-2026-69220-15988da5","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readArray"},"deprecated":false,"digest":{"function_hash":"206302616344266429658186054002794125005","length":306},"id":"CVE-2026-69220-1ca65da6","signature_type":"Function"},{"digest":{"line_hashes":["146163576496411560973782605996143084386","76310195553827986896227266286916695852","105390231594679490036761533706997942316","308344932895919696172843753977306626870","232218538313958377522913666234698068875","252048873432584606933775354998998352183"],"threshold":0.9},"id":"CVE-2026-69220-36eeb14e","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc","target":{"file":"src/test/java/com/rabbitmq/client/impl/ValueReaderTest.java"},"deprecated":false},{"digest":{"function_hash":"143284566018138388478333603813221206192","length":433},"id":"CVE-2026-69220-42670863","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readTable"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["146163576496411560973782605996143084386","76310195553827986896227266286916695852","105390231594679490036761533706997942316","308344932895919696172843753977306626870","232218538313958377522913666234698068875","252048873432584606933775354998998352183"]},"id":"CVE-2026-69220-4c01bee7","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","target":{"file":"src/test/java/com/rabbitmq/client/impl/ValueReaderTest.java"},"deprecated":false},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readFieldValue"},"deprecated":false,"digest":{"function_hash":"2658565536881186807918581216138621940","length":1091},"id":"CVE-2026-69220-6dd6ae5b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false,"digest":{"line_hashes":["76100853822819197074827025823569942820","58926869545079268352440437759704438922","129411003464272653601378128491832805297","107612199244578483059685887271964084151","310943910456439700655890748838478260340","221455567114439039241007944406696668963","327737949324455651464515619041600490005","219039220460291763013406995134186915472","63178143248342970974392113414512974492","43404521502246945946844370067804300564","7273953978226027369107574421940001753","41908634176594056647217766721896511651","264872644837580833980651541985277829397","35734191769802773179203927714590103966","243454462654621830500817771802919859033","316099736504019112352379047143507204005","141739956655248916918857956337899166852","304875166809052667620681870707050977396","230669114280158349898446852772595061465","307755400442946394221418499418102257497","177597456391047453723727214661713974605","65561955144893241388393033111120422505","44117693679621801116368621335397438445","191209010891050008609045806328307320616","146189126529233330717354246757269294145","89877310794001225256960403879976401687","184946086285555577434477594210948939557","261088573714376971299385859434164064661","48406677325403234463571519954190810793","192401030350717040598466667183018886776","79655077079706357207853480242199047806","191477670298004681037243377050932886359","166157004490746975345328287619128350269","9595428293780561109555821088144707503","280109824087579346930530342611222029239","153422122677919263254676664250534255115","220289148070374345064823363607408523357","169606618840355948054443632951072098219","339920621060837983157569570895330111413","140839330736816165009213543755301104263","41461993019685949574505133338388250606","248626489498514232652077802898777698696","108951856896193541020783618238614487626","164412673827984987850079296530201101265","50285506919989734804913371778460929040","210226594194587708694763910640395713955","56145557665558676316691943042283860725","292451377264193999237451296338846771532"],"threshold":0.9},"id":"CVE-2026-69220-7a789b8d","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readArray"},"deprecated":false,"digest":{"function_hash":"206302616344266429658186054002794125005","length":306},"id":"CVE-2026-69220-afede3ad","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"143284566018138388478333603813221206192","length":433},"id":"CVE-2026-69220-b1ebee9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readTable"}},{"digest":{"line_hashes":["76100853822819197074827025823569942820","58926869545079268352440437759704438922","129411003464272653601378128491832805297","107612199244578483059685887271964084151","310943910456439700655890748838478260340","221455567114439039241007944406696668963","327737949324455651464515619041600490005","219039220460291763013406995134186915472","63178143248342970974392113414512974492","43404521502246945946844370067804300564","7273953978226027369107574421940001753","41908634176594056647217766721896511651","264872644837580833980651541985277829397","35734191769802773179203927714590103966","243454462654621830500817771802919859033","316099736504019112352379047143507204005","141739956655248916918857956337899166852","304875166809052667620681870707050977396","230669114280158349898446852772595061465","307755400442946394221418499418102257497","177597456391047453723727214661713974605","65561955144893241388393033111120422505","44117693679621801116368621335397438445","191209010891050008609045806328307320616","146189126529233330717354246757269294145","89877310794001225256960403879976401687","184946086285555577434477594210948939557","261088573714376971299385859434164064661","48406677325403234463571519954190810793","192401030350717040598466667183018886776","79655077079706357207853480242199047806","191477670298004681037243377050932886359","166157004490746975345328287619128350269","9595428293780561109555821088144707503","280109824087579346930530342611222029239","153422122677919263254676664250534255115","220289148070374345064823363607408523357","169606618840355948054443632951072098219","339920621060837983157569570895330111413","140839330736816165009213543755301104263","41461993019685949574505133338388250606","248626489498514232652077802898777698696","108951856896193541020783618238614487626","164412673827984987850079296530201101265","50285506919989734804913371778460929040","210226594194587708694763910640395713955","56145557665558676316691943042283860725","292451377264193999237451296338846771532"],"threshold":0.9},"id":"CVE-2026-69220-ce1dfdc3","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69220.json","vanir_signatures_modified":"2026-08-20T09:52:35Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}