A vulnerability in the RabbitMQ Java client library allows unauthenticated remote attackers to trigger memory exhaustion and service termination by sending specially crafted AMQP frames.

This issue is caused by improper handling of zero-value frame limits during connection negotiation, which results in the client library unintentionally disabling inbound message size caps. An unauthenticated attacker acting as a malicious server or a man-in-the-middle can exploit this to force the client to allocate excessive memory, leading to a process crash.

Successful exploitation of this vulnerability results in a denial of service for any Java application utilizing the affected library to communicate with RabbitMQ. Given the CVSS score of 8.7, the impact is considered severe because it can lead to significant application downtime and instability. This vulnerability is particularly concerning for enterprise environments where reliable messaging infrastructure is critical for business operations.

Immediate Action: Update the RabbitMQ Java client library dependency to version 5.34.0 or later to ensure the frame size logic is correctly constrained.

Proactive Monitoring: Monitor application logs and system resource metrics for sudden spikes in memory usage or unexpected termination events associated with the RabbitMQ client.

Compensating Controls: Implement network-level controls or mutual TLS (mTLS) to prevent unauthorized or malicious servers from establishing connections with the client.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Organizations utilizing the RabbitMQ Java client must prioritize upgrading to version 5.34.0 immediately. The high CVSS score reflects the ease of exploitation and the potential for complete service disruption, making this update a critical requirement for maintaining system availability and security integrity.