High severity · published Aug 18, 2026
CVE-2026-69220
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
8.7
CVSS
0.7%
EPSS
No
On KEV
Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values without a nesting-depth limit. A malicious AMQP server or network intermediary can send approximately 580 nested table levels in the pre-authentication connection.start frame, fitting within the default 131072-byte frame maximum, to trigger StackOverflowError. The error terminates the client input processing thread and causes denial of service. This issue is fixed in version 5.33.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rabbitmq-java-client · rabbitmq
< 5.33.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69220
github.com
https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0
github.com
https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc
github.com
https://github.com/rabbitmq/rabbitmq-java-client/pull/2007
github.com
https://github.com/rabbitmq/rabbitmq-java-client/pull/2008
github.com
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1
github.com
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4
More from rabbitmq-java-client
8.7
CVE-2026-75516
RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
8.7
CVE-2026-69219
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
7.5
CVE-2026-106122
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
7.5
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
7.5
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
