The vulnerability arises from improper validation of AMQP frames in the RabbitMQ Java client’s CommandAssembler component. When a broker sends a content‑bearing method followed by a header whose remainingBodyBytes is smaller than the following frame body payload, the assembler subtracts the payload length before performing bounds checks. This results in a negative remainingBodyBytes value and causes a raw UnsupportedOperationException instead of the expected MalformedFrameException. The flaw is an instance of CWE‑20: Improper Input Validation and can halt client processing.

The affected product is the RabbitMQ Java client library (rabbitmq:rabbitmq-java-client). Every release prior to 5.31.0, including all 5.30.x versions, is vulnerable. The issue was patched in version 5.31.0 and later.

The CVSS base score of 6.3 places this vulnerability in the medium severity range. EPSS information is not available and the flaw is not listed in the CISA KEV catalog. The attack requires a broker that can send a specially crafted malformed frame on a channel that remains open and non‑zero. A compromised or malicious broker can exploit this flaw to force the client to throw an exception and close the connection, resulting in a denial of service for applications relying on that connection. The vulnerability is confined to traffic from a broker to the client; outward threats are not applicable.