CVE-2026-75516 rabbitmq CVE debrief

Who should care

Defenders responsible for configuring and maintaining RabbitMQ Java client library should assess exposure and prioritize updating to version 5.34.0 or later. They should also verify the configuration of RabbitMQ Java client library and monitor for potential memory exhaustion and client process termination.

Why it matters

CVE-2026-75516 is a high-severity vulnerability in the RabbitMQ Java client library that could allow a malicious AMQP server or man-in-the-middle attacker to send oversized frames, potentially causing memory exhaustion and client process termination. Defenders should prioritize updating to version 5.34.0 or later and verifying the configuration of RabbitMQ Java client library.

• Potential memory exhaustion and client process termination
• Verification of RabbitMQ Java client library configuration
• Update to version 5.34.0 or later to fix the issue

Technical summary

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. This issue can be mitigated by updating to version 5.34.0 or later and verifying the configuration of RabbitMQ Java client library. The vulnerability is caused by the incorrect application of Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation.

Defensive priority

Defenders should prioritize updating to version 5.34.0 or later and verifying the configuration of RabbitMQ Java client library.

Recommended defensive actions

• Update to RabbitMQ Java client library version 5.34.0 or later
• Verify the configuration of RabbitMQ Java client library
• Monitor for potential memory exhaustion and client process termination
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the incorrect application of Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation. The issue is fixed in version 5.34.0. Defenders should verify the configuration of RabbitMQ Java client library and monitor for potential memory exhaustion and client process termination. The CVE record was published on 2026-09-16T19:17:33.560Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.