Login Request a demo
High severity · published Oct 25, 2023
CVE-2023-46120
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RJ
Rabbitmq Java Client · Vmware
before 5.18.0 · source: NVD
Affected product
RJ
Rabbitmq Java Client
Vmware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46120
Patch
https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
Issue Tracking
https://github.com/rabbitmq/rabbitmq-java-client/issues/1062
Release Notes
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
Exploit
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
More from Rabbitmq Java Client
7.5
CVE-2026-106122
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
7.5
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
5.9
CVE-2018-11087
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation
5.5
CVE-2026-106123
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()