CVE-2023-46120 json
RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
published 2023-10-24 3 y ago modified 2026-09-10 1 mo ago also GHSA-mm8h-8587-p46h , EUVD-2023-2776
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Patch / fix
- maven com.rabbitmq:amqp-client 5.18.0
- rabbitmq rabbitmq-java-client 5.18.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-24-228-06 updated cvss 4.9
Siemens SINEC NMS
-
Siemens SINEC NMS <V3.0affected: fixed in V3.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-046-15 updated cvss 4.9
Siemens SINEC NMS
-
Siemens SINEC NMS <V2.0_SP1affected: fixed in V2.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.rabbitmq:amqp-client | <5.18.0 |
5.18.0 |
Affected products
- rabbitmq rabbitmq-java-client
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8
web, patch
-
github.com
/rabbitmq/rabbitmq-java-client/issues/1062
web, issue-tracking, patch
-
github.com
/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h
web, exploit, vendor-advisory
-
github.com
/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-46120
advisory
-
github.com
/rabbitmq/rabbitmq-java-client
package
Sources
- CVE List CVE-2023-46120
- GitHub Advisory GHSA-mm8h-8587-p46h
- NVD CVE-2023-46120
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.