CVE-2023-46120mediumCWE-400

CVE-2023-46120: fallo de gravedad media en rabbitmq-java-client

RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear rabbitmq-java-client+ Monitorear com.rabbitmq:amqp-client

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.9epss 1.3%
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Productos afectados
rabbitmq · rabbitmq-java-client
CVEs relacionadas — rabbitmq-java-client

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-69220HIGHRabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSEPSS 0.7%CVE-2026-69219HIGHRabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationEPSS 0.7%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.6%CVE-2026-75516HIGHRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementEPSS 0.6%CVE-2026-106121MEDIUMRabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSEPSS 0.5%CVE-2026-63335MEDIUMRabbitMQ Java client malformed body frame triggers raw command assembler exceptionEPSS 0.5%