CVE-2023-46120: rabbitmq rabbitmq-java-client Uncontrolled Resource Consumption
Vulnerability summary
CVE-2023-46120 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in rabbitmq rabbitmq-java-client. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 24-10-2023PublishedVulnerability first disclosed.
- 11-09-2024Last modifiedVulnerability information updated.
Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
CVSS metrics
7 scores · 7 sources · 1 version- CVE.orgCNA4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · MavenEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
1.07%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
+0.01 pp
From 1.06% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundRabbitmq Java Client
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- cassandra-reaper< 4.0.1-r1
- trino< 478-r2
Wolfi2 products
- cassandra-reaper< 4.0.1-r1
- trino< 478-r2
Com.rabbitmq1 product
- amqp-client< 5.18.0
Debian1 product
- rabbitmq-java-clientAll versions (No fix recorded)
Rabbitmq1 product
- rabbitmq-java-client< 5.18.0
Ubuntu1 product
- rabbitmq-java-clientAll versions (No fix recorded)
Vmware1 product
- rabbitmq_java_client< 5.18.0
7 vendors · 9 products
References
10 links- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46hX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8X Refsource MISCREPORTFIXWEBPatch
