{"items":[{"id":"NVI-00015282","kind":"vulnerability","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-68mj-5wr7-6fgg","CVE-2026-69219"],"plain_summary":"GitHub lists this reviewed advisory for com.rabbitmq:amqp-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1849ec12cee4ab848916cc2a096bc907"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-22T22:10:00.250Z","value":"8.7 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-1849ec12cee4ab848916cc2a096bc907"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-51c451fe11e20ba5d110bd4a7570952a","url":"https://github.com/advisories/GHSA-68mj-5wr7-6fgg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-68mj-5wr7-6fgg","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:15:44.568Z"},{"id":"sr-1849ec12cee4ab848916cc2a096bc907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69219","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-69219","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T15:07:54.921Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-51c451fe11e20ba5d110bd4a7570952a"],"technology":"com.rabbitmq:amqp-client","known_exclusions":[],"conditions_summary":"## Summary\n\n`ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.\n\n## Vulnerable Code\n\n`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95:\n\n```java\nprivate static byte[] readBytes(final DataInputStream in) throws IOException {\n    final long contentLength = unsignedExtend(in.readInt());\n    if(contentLength < Integer.MAX_VALUE) {\n        final byte[] buffer = new byte[(int)contentLength];  // allocates before reading\n        in.readFully(buffer);\n        return buffer;\n    }\n}\n```\n\n## Attack Scenario\n\nA malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength < Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data.\n\nThe allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table.\n\n## Impact\n\nDenial of ser","public_affected_ranges":["<= 5.33.0"]}],"null_published_at":"2026-11-08T19:53:44.029Z","source_updated_at":"2026-08-18T16:32:22.000Z","source_disclosed_at":"2026-08-18T16:32:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T20:15:44.568Z"},{"id":"NVI-00015282","kind":"vulnerability","title":"RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-68mj-5wr7-6fgg","CVE-2026-69219"],"plain_summary":"GitHub lists this reviewed advisory for com.rabbitmq:amqp-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-51c451fe11e20ba5d110bd4a7570952a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-51c451fe11e20ba5d110bd4a7570952a","url":"https://github.com/advisories/GHSA-68mj-5wr7-6fgg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-68mj-5wr7-6fgg","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:15:44.568Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-51c451fe11e20ba5d110bd4a7570952a"],"technology":"com.rabbitmq:amqp-client","known_exclusions":[],"conditions_summary":"## Summary\n\n`ValueReader.readBytes()` allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a ~2GB string/bytes field.\n\n## Vulnerable Code\n\n`src/main/java/com/rabbitmq/client/impl/ValueReader.java` lines 83-95:\n\n```java\nprivate static byte[] readBytes(final DataInputStream in) throws IOException {\n    final long contentLength = unsignedExtend(in.readInt());\n    if(contentLength < Integer.MAX_VALUE) {\n        final byte[] buffer = new byte[(int)contentLength];  // allocates before reading\n        in.readFully(buffer);\n        return buffer;\n    }\n}\n```\n\n## Attack Scenario\n\nA malicious AMQP server sends a LongString field (type tag 'S') with declared length `0x7FFFFFFE` (2,147,483,646). The check `contentLength < Integer.MAX_VALUE` passes. `new byte[2147483646]` attempts ~2GB allocation, causing `OutOfMemoryError` before `readFully()` attempts to read data.\n\nThe allocation size is attacker-controlled and is NOT validated against the frame size or `TruncatedInputStream` bounds. Exploitable pre-authentication via `connection.start` server-properties table.\n\n## Impact\n\nDenial of ser","public_affected_ranges":["<= 5.33.0"]}],"null_published_at":"2026-11-03T10:03:26.567Z","source_updated_at":"2026-08-18T16:32:22.000Z","source_disclosed_at":"2026-08-18T16:32:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:15:44.568Z"}],"next_cursor":null,"snapshot_revision":"42594"}