The RabbitMQ Java client accepts frames whose payload exceeds the negotiated AMQP frame_max, allowing a broker to send oversized method frames that the client will allocate and attempt to decode. This results in protocol violations that disrupt the client connection and lead to a denial‑of‑service condition for the application using the client library. The weakness is identified as an improper input validation flaw (CWE‑20).

The vulnerability affects the RabbitMQ Java client library distributed by RabbitMQ. Versions prior to 5.33.0 are impacted, covering all releases that have not applied the fix introduced in v5.33.0.

The risk is client‑side denial of service triggered by a malicious or compromised broker. The exploit requires control or subversion of the broker to send frames larger than the negotiated limit. No exploit probability (EPSS) data is available and the vulnerability is not listed in the CISA KEV catalog, but the absence of a mitigation by default in the client means the lack of a proper boundary check makes exploitation straightforward for an actor controlling the broker. The CVSS score is not specified, but given the potential for service interruption it poses a significant operational risk for applications that rely on the client library.