AIKIDO-2026-973884
amqp-client is vulnerable to Uncontrolled Resource Consumption
87
High Risk
This Affects:
amqp-clientTL;DR
The AMQP client negotiates a maximum frame size with the server during connection setup. When the server reports frameMax as zero, meaning unlimited, the client computes Math.min(maxInboundMessageBodySize, 0) and treats the resulting zero as unlimited, disabling the inbound message body size cap. An untrusted or intercepting server can then send a single very large frame that triggers a huge allocation and an out-of-memory crash before the connection is fully established. The fix uses the configured inbound body size limit as the cap when the negotiated frame size is unlimited.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application connects to an untrusted or externally controlled AMQP server.
Background info
amqp-client is vulnerable to Uncontrolled Resource Consumption in versions 5.33.0 - 5.33.1.
How to fix this
Upgrade the com.rabbitmq:amqp-client library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant