Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-63335RabbitMQ Java client malformed body frame triggers raw command assembler exception

Medium 6.3

In plain English

A medium-severity improper input validation in rabbitmq-java-client from rabbitmq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY payload. CommandAssembler.consumeBodyFrame subtracts the peer-controlled payload length before validating that it fits, drives remainingBodyBytes negative, and throws a raw UnsupportedOperationException instead of MalformedFrameException. A malicious or compromised broker peer can send this malformed sequence on an open nonzero channel to terminate frame processing and close the client connection, causing denial of service for work using that connection. This issue is fixed in version 5.31.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rabbitmq-java-client	no fix listed	DEBIAN-CVE-2026-63335
Debian:13	rabbitmq-java-client	no fix listed	DEBIAN-CVE-2026-63335
Maven	com.rabbitmq:amqp-client	5.31.0	GHSA-qx7j-jv8m-fppr
Ubuntu:22.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63335
Ubuntu:24.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63335
Ubuntu:26.04:LTS	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63335
Ubuntu:26.10	rabbitmq-java-client	no fix listed	UBUNTU-CVE-2026-63335

Affected products (as reported)

Vendor	Product	Versions
rabbitmq	rabbitmq-java-client	< 5.31.0

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H

References

https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-java-client/pull/1959 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/pull/1960 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0 x_refsource_MISC