CVE-2026-69220 rabbitmq CVE debrief

Who should care

Defenders responsible for Java and JVM-based applications using the RabbitMQ Java client library should assess their exposure and prioritize updating to version 5.33.1 or later to prevent denial-of-service attacks.

Why it matters

CVE-2026-69220 is a denial-of-service vulnerability in the RabbitMQ Java client library. Defenders should prioritize updating to version 5.33.1 or later to prevent denial-of-service attacks. Java and JVM-based applications using the RabbitMQ Java client library should assess their exposure and verify the version used. The vulnerability allows a malicious AMQP server or network intermediary to send a specially crafted pre-authentication connection.start frame to trigger a StackOverflowError, terminating the client input processing thread and causing denial of service.

• Denial of service due to StackOverflowError
• Termination of client input processing thread
• Potential disruption of Java and JVM-based applications using the RabbitMQ Java client library

Technical summary

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, a malicious AMQP server or network intermediary can send a specially crafted pre-authentication connection.start frame to trigger a StackOverflowError, terminating the client input processing thread and causing denial of service. The error occurs due to recursive calls in ValueReader.readFieldValue for AMQP table type F and AMQP array type A values without a nesting-depth limit. This issue is fixed in version 5.33.1, which adds a limit to prevent such recursive calls.

Defensive priority

Defenders should prioritize updating to version 5.33.1 or later to prevent denial-of-service attacks. Java and JVM-based applications using the RabbitMQ Java client library should assess their exposure and verify the version used.

Recommended defensive actions

• Update to RabbitMQ Java client library version 5.33.1 or later
• Assess exposure of Java and JVM-based applications using the RabbitMQ Java client library
• Verify the version of the RabbitMQ Java client library used in your environment
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. GitHub references provide additional context on the fix and vulnerability disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.