Maven · com.rabbitmq:amqp-client
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
ValueReader.readBytes() allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 83-95:
private static byte[] readBytes(final DataInputStream in) throws IOException {
final long contentLength = unsignedExtend(in.readInt());
if(contentLength < Integer.MAX_VALUE) {
final byte[] buffer = new byte[(int)contentLength]; // allocates before reading
in.readFully(buffer);
return buffer;
}
}
A malicious AMQP server sends a LongString field (type tag 'S') with declared length 0x7FFFFFFE (2,147,483,646). The check contentLength < Integer.MAX_VALUE passes. new byte[2147483646] attempts ~2GB allocation, causing OutOfMemoryError before readFully() attempts to read data.
The allocation size is attacker-controlled and is NOT validated against the frame size or TruncatedInputStream bounds. Exploitable pre-authentication via connection.start server-properties table.
Denial of service via JVM OutOfMemoryError. Crashes the entire JVM.
CWE-789: Memory Allocation with Excessive Size Value
Validate contentLength against the frame's remaining bytes or the negotiated max frame size (default 131,072) before allocating.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.