Bug#1144958: rabbitmq-java-client: CVE-2026-61634 CVE-2026-63335 CVE-2026-63336 CVE-2026-63337 CVE-2026-69219 CVE-2026-69220

Source: rabbitmq-java-client
Version: 5.0.0-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for rabbitmq-java-client.

CVE-2026-61634[0]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.33.0, the AMQP connection tuning path records the negotiated
| AMQP frame_max value, but
| src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and
| NettyFrameHandlerFactory continue to validate broker-controlled
| frame payload lengths against maxInboundMessageBodySize because the
| negotiated limit is not applied consistently through
| setMaxInboundFramePayloadSize. A malicious or compromised broker can
| send a method frame larger than the negotiated frame_max during or
| after connection establishment, causing the client to allocate and
| decode a protocol-invalid frame instead of rejecting it with
| MalformedFrameException. The protocol violation can disrupt the
| affected connection and cause client-side denial of service. This
| issue is fixed in version 5.33.0.


CVE-2026-63335[1]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.31.0, inbound AMQP command assembly in
| src/main/java/com/rabbitmq/client/impl/CommandAssembler.java
| processes a content-bearing method and header whose
| remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY
| payload. CommandAssembler.consumeBodyFrame subtracts the peer-
| controlled payload length before validating that it fits, drives
| remainingBodyBytes negative, and throws a raw
| UnsupportedOperationException instead of MalformedFrameException. A
| malicious or compromised broker peer can send this malformed
| sequence on an open nonzero channel to terminate frame processing
| and close the client connection, causing denial of service for work
| using that connection. This issue is fixed in version 5.31.0.


CVE-2026-63336[2]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol()
| and ConnectionFactory.useSslProtocol(String) configure
| com.rabbitmq.client.TrustEverythingTrustManager and leave hostname
| verification disabled, causing arbitrary server certificates,
| including self-signed certificates, to be accepted. A network
| attacker able to intercept a TLS connection can impersonate the
| RabbitMQ broker, read protected AMQP traffic, and modify traffic
| without certificate or hostname validation. The fix changes the
| production TLS helpers to use the JVM default trust store and
| enables hostname verification, while retaining an explicitly named
| development-only no-verification helper. This issue is fixed in
| version 5.33.0.


CVE-2026-63337[3]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives
| a javaReturnType value in an untrusted system.describe response and
| passes it through JSONUtil.tryFill, setJavaReturnType, and
| computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with
| initialization enabled. An attacker able to answer the JsonRpcClient
| request through a shared broker or network interception can select a
| class already present in the victim JVM and trigger its static
| initializer, while JsonRpcClient.java later passes getReturnType
| output to mapper.parse and may also create type confusion.
| Successful exploitation can affect confidentiality, integrity, and
| availability in the client process. This issue is fixed in version
| 5.33.0.


CVE-2026-69219[4]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java
| uses ValueReader.readBytes to accept a wire-declared contentLength
| below Integer.MAX_VALUE and allocate a byte array before checking
| the bytes available in the frame. A malicious AMQP peer can send a
| LongString or byte-array field with type tag S and a declared length
| such as 0x7FFFFFFE during the pre-authentication connection.start
| server-properties table, causing an approximately 2 GB allocation
| and OutOfMemoryError before readFully consumes data. The resulting
| memory exhaustion can terminate the JVM and cause denial of service.
| This issue is fixed in version 5.33.1.


CVE-2026-69220[5]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java
| permits ValueReader.readTable and ValueReader.readArray to call
| ValueReader.readFieldValue recursively for AMQP table type F and
| AMQP array type A values without a nesting-depth limit. A malicious
| AMQP server or network intermediary can send approximately 580
| nested table levels in the pre-authentication connection.start
| frame, fitting within the default 131072-byte frame maximum, to
| trigger StackOverflowError. The error terminates the client input
| processing thread and causes denial of service. This issue is fixed
| in version 5.33.1.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-61634
    https://www.cve.org/CVERecord?id=CVE-2026-61634
[1] https://security-tracker.debian.org/tracker/CVE-2026-63335
    https://www.cve.org/CVERecord?id=CVE-2026-63335
[2] https://security-tracker.debian.org/tracker/CVE-2026-63336
    https://www.cve.org/CVERecord?id=CVE-2026-63336
[3] https://security-tracker.debian.org/tracker/CVE-2026-63337
    https://www.cve.org/CVERecord?id=CVE-2026-63337
[4] https://security-tracker.debian.org/tracker/CVE-2026-69219
    https://www.cve.org/CVERecord?id=CVE-2026-69219
[5] https://security-tracker.debian.org/tracker/CVE-2026-69220
    https://www.cve.org/CVERecord?id=CVE-2026-69220

Regards,
Salvatore