The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of service. This issue is fixed in version 5.33.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with     RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses     ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte     array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or     byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication     connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError     before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of     service. This issue is fixed in version 5.33.1. (CVE-2026-69219)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with
    RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses
    ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte
    array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString or
    byte-array field with type tag S and a declared length such as 0x7FFFFFFE during the pre-authentication
    connection.start server-properties table, causing an approximately 2 GB allocation and OutOfMemoryError
    before readFully consumes data. The resulting memory exhaustion can terminate the JVM and cause denial of
    service. This issue is fixed in version 5.33.1. (CVE-2026-69219)

ID	Name	Product	Family	Type	Severity
338044	Linux Distros Unpatched Vulnerability : CVE-2026-69219	Nessus	Misc.	Local	high
446050	SCA: security update for com.rabbitmq:amqp-client (GHSA-68mj-5wr7-6fgg)	Tenable Cloud Security	SCA Checks	Local	high
446050	SCA: security update for com.rabbitmq:amqp-client (GHSA-68mj-5wr7-6fgg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-69219

high

Tenable Plugins

high

high

high