Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| rabbitmq | rabbitmq-java-client | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-2776 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0. |
 Github GHSA |
GHSA-mm8h-8587-p46h | RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-09-11T13:20:34.629Z
Reserved: 2023-10-16T17:51:35.571Z
Link: CVE-2023-46120
Vulnrichment
Updated: 2024-08-02T20:37:39.470Z
NVD
Status : Modified
Published: 2023-10-25T18:17:36.257
Modified: 2024-11-21T08:27:55.207
Link: CVE-2023-46120
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses