A malicious AMQP server or network intermediary can send an AMQP frame containing an extraordinarily deep nesting of tables or arrays. The client library’s ValueReader parses these value types recursively without enforcing a depth limit, which can cause the Java virtual machine to exhaust stack space and trigger a StackOverflowError. The error aborts the client’s input thread, effectively terminating the application without a graceful shutdown and thereby denying service to legitimate clients.

The vulnerability exists in the RabbitMQ Java client library for any version prior to 5.33.1. Applications that rely on older releases of this library and that connect to RabbitMQ nodes are potentially impacted.

The CVSS score of 8.7 indicates a high risk of exploitation, and although an EPSS value is not provided, the absence of a depth check means the flaw can be leveraged remotely by an attacker who can control the server or relay traffic. The issue is not listed in CISA’s KEV catalog, but the severity and straightforward exploitation scenario warrant immediate attention.