CVE-2026-63335 rabbitmq CVE debrief

Who should care

Defenders responsible for RabbitMQ Java client library deployments should assess exposure and prioritize updating to version 5.31.0 or later to prevent potential denial of service attacks.

Why it matters

CVE-2026-63335 vulnerability in RabbitMQ Java client library allows for denial of service attacks; defenders should prioritize updating to version 5.31.0 or later.

• Denial of service for work using the affected connection
• Potential disruption to applications relying on RabbitMQ Java client library

Technical summary

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection.

Defensive priority

Defenders should prioritize updating to version 5.31.0 or later to prevent potential denial of service attacks.

Recommended defensive actions

• Update to version 5.31.0 or later
• Review and verify the RabbitMQ Java client library version in use
• Monitor for potential denial of service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. The vulnerability is caused by the CommandAssembler.consumeBodyFrame method processing a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. Defenders should verify the RabbitMQ Java client library version in use and review 5

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.