Maven · com.rabbitmq:amqp-client
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
ValueReader.readTable() and readArray() recursively call readFieldValue() with no depth limit. A malicious AMQP peer can crash the client JVM by sending a deeply nested table structure.
src/main/java/com/rabbitmq/client/impl/ValueReader.java lines 139-155 and 237-249:
private static Map<String, Object> readTable(DataInputStream in) throws IOException {
long tableLength = unsignedExtend(in.readInt());
// ...
while(tableIn.available() > 0) {
String name = readShortstr(tableIn);
Object value = readFieldValue(tableIn); // recursive call
}
}
static Object readFieldValue(DataInputStream in) throws IOException {
switch(in.readUnsignedByte()) {
case 'F': value = readTable(in); // mutual recursion
case 'A': value = readArray(in); // mutual recursion
}
}
A malicious AMQP server (or MitM) sends a connection.start frame with 580 levels of nested tables. Each level costs ~7 bytes (4-byte length + 1-byte key length + 1-byte key + 1-byte type tag), totaling ~4060 bytes within the 131,072 byte max frame size. With the default JVM stack (512KB, ~864 bytes/frame), this triggers StackOverflowError, killing the I/O thread.
Exploitable pre-authentication since connection.start is the very first server frame.
Denial of service. StackOverflowError kills the client I/O thread.
CWE-674: Uncontrolled Recursion
Add a depth counter to readTable/readArray/readFieldValue and throw MalformedFrameException when exceeding a threshold (e.g., 32).
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.