The RabbitMQ Java client contains a flaw where the ValueReader component allocates a byte array based on a content length declared by a remote AMQP peer without first confirming sufficient bytes are available. An attacker can send an oversized LongString or byte array field during the pre‑authentication connection.start server‑properties table, causing the client to attempt an allocation close to 2 GB. This allocation can trigger an OutOfMemoryError, terminating the Java Virtual Machine and resulting in denial of service for the application.

Clients using the RabbitMQ Java client library version 5.32.x and earlier are affected. The vulnerability is fixed in version 5.33.1; all subsequent releases contain the patch. Only the RabbitMQ Java client component is impacted, not the broker itself.

The CVSS score of 8.7 indicates a high severity; the lack of an available EPSS score does not diminish the risk, as the vulnerability permits remote exploitation over the AMQP protocol. Because the attacker sends data over an established network connection, the exploit does not require elevated privileges on the host. The issue is not listed in the CISA KEV catalog, implying no known widespread exploitation, but its high severity and remote nature warrant attention. The risk can be mitigated by updating the library promptly.