CVE-2023-46120CWE-400

RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

Medium · published October 24, 2023

CVSS v3.1
4.9
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01069 · 64.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-10-24T23:05Z
EPSS history
Timeline
  • 24 OCT 23:05Z
    RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
    cvelistv5