CVE-2026-75516 with a CVSS score of 8.7 is a high-severity vulnerability affecting amqp-client versions < 5.34.0 in the RabbitMQ Java client, where an attacker can exploit frame-level OOM by sending a malicious AMQP server or MITM that sets `frameMax=0` in the `Connection.Tune` negotiation, thereby defeating the `maxInboundMessageBodySize` protection at the frame level. This allows for single-frame OOM and bypasses existing protection, affecting default configurations and legitimate servers' `frameMax` values in Tune. The vulnerability is due to a bug in the `AMQConnection.java` code where `Math.min(maxInboundMessageBodySize, 0)` treats `frameMax=0` as an integer value zero instead of its intended meaning of 'unlimited', leading to a frame-layer allocation site in `Frame.readFrom` that triggers up to ~2GB allocation. The affected component is the rating block's custom icon rendering component, and the attack vector is via the environment template management API; however, the actual vulnerability lies in the AMQP protocol's handling of frame sizes.
We recommend you to update RabbitMQ Java client to version 5.34.0.[/subscribe_to_unlock_form]
CVE-2026-75516 with a CVSS score of 8.7 is a high-severity vulnerability affecting amqp-client versions < 5.34.0 in the RabbitMQ Java client, where an attacker can exploit frame-level OOM by sending a malicious AMQP server or MITM that sets `frameMax=0` in the `Connection.Tune` negotiation, thereby defeating the `maxInboundMessageBodySize` protection at the frame level. This allows for single-frame OOM and bypasses existing protection, affecting default configurations and legitimate servers' `frameMax` values in Tune. The vulnerability is due to a bug in the `AMQConnection.java` code where `Math.min(maxInboundMessageBodySize, 0)` treats `frameMax=0` as an integer value zero instead of its intended meaning of 'unlimited', leading to a frame-layer allocation site in `Frame.readFrom` that triggers up to ~2GB allocation. The affected component is the rating block's custom icon rendering component, and the attack vector is via the environment template management API; however, the actual vulnerability lies in the AMQP protocol's handling of frame sizes.
We recommend you to update RabbitMQ Java client to version 5.34.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]