logo

Database

Improper resource allocation In rabbitmq-java-client

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2023-461202. NVD-2023-461203. OSV-2023-461204. OSV-DEBIAN-2023-461205. GHSA-mm8h-8587-p46h6. GCVE-2023-461207. SECURITY-TRACKER-CVE-2023-46120

References

1. https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h2. https://github.com/rabbitmq/rabbitmq-java-client/issues/10623. https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc84. https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.