Summary
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
ValueReader.readBytes() allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.
Vulnerable Code
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 83-95:
private static byte[] readBytes(final DataInputStream in) throws IOException {
final long contentLength = unsignedExtend(in.readInt());
if(contentLength < Integer.MAX_VALUE) {
final byte[] buffer = new byte[(int)contentLength]; // allocates before reading
in.readFully(buffer);
return buffer;
}
}
Attack Scenario
A malicious AMQP server sends a LongString field (type tag 'S') with declared length 0x7FFFFFFE (2,147,483,646). The check contentLength < Integer.MAX_VALUE passes. new byte[2147483646] attempts ~2GB allocation, causing OutOfMemoryError before readFully() attempts to read data.
The allocation size is attacker-controlled and is NOT validated against the frame size or TruncatedInputStream bounds. Exploitable pre-authentication via connection.start server-properties table.
CWE
CWE-789: Memory Allocation with Excessive Size Value
Impact
Denial of service via JVM OutOfMemoryError. Crashes the entire JVM.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Validate contentLength against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.
Frequently Asked Questions
- What is CVE-2026-69219? CVE-2026-69219 is a high-severity security vulnerability in com.rabbitmq:amqp-client (maven), affecting versions <= 5.33.0. It is fixed in 5.33.1.
- Which versions of com.rabbitmq:amqp-client are affected by CVE-2026-69219? com.rabbitmq:amqp-client (maven) versions <= 5.33.0 is affected.
- Is there a fix for CVE-2026-69219? Yes. CVE-2026-69219 is fixed in 5.33.1. Upgrade to this version or later.
- Is CVE-2026-69219 exploitable, and should I be worried? Whether CVE-2026-69219 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-69219 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-69219? Upgrade
com.rabbitmq:amqp-clientto 5.33.1 or later.