The vulnerability arises because the stream protocol in RabbitMQ does not validate the length of an inbound frame against the negotiated FrameMax value. This oversight allows a remote client to send a frame larger than the allowed maximum, which the broker buffers without checking. The resulting memory consumption can cause the broker to exhaust available memory, leading to a denial of service. The weakness is classified under CWE‑770, representing resource exhaustion.

The flaw affects RabbitMQ Server versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6 when the stream plugin is enabled. Production deployments of these affected releases utilizing the stream protocol are at risk.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not available and the bug is not listed in CISA’s KEV catalog. The likely attack vector is a remote client connecting to the broker and announcing an oversized frame during normal stream traffic. No special privileges are required beyond normal client access; thus the vulnerability is readily exploitable by any party able to communicate with the broker over the stream channel. Once triggered, the broker’s memory usage can rise sharply, potentially causing service interruption for all consumers and producers using that broker.