CVE-2026-75516

Maven/com.rabbitmq:amqp-client CVE-2026-75516: high

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Action: Upgrade com.rabbitmq:amqp-client to 5.34.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-jh4v-gfqj-7rhx
• https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-jh4v-gfqj-7rhx
• https://nvd.nist.gov/vuln/detail/CVE-2026-75516
• https://github.com/rabbitmq/rabbitmq-java-client/pull/2015
• https://github.com/rabbitmq/rabbitmq-java-client/pull/2016
• https://github.com/rabbitmq/rabbitmq-java-client/commit/6d7c2bfe89796ca34d3531098fb59dd657fea39e
• https://github.com/rabbitmq/rabbitmq-java-client/commit/e7f10bf99aee103dd9f64b3e52a725fc9f9d3763
• https://github.com/rabbitmq/rabbitmq-java-client
• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.34.0

CVE-2026-75516 · published 2026-09-17T14:52:21Z · modified 2026-09-17T15:00:06.805894716Z · JSON