The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level validation and potentially terminate the client process through memory exhaustion. This issue is fixed in version 5.34.0.

Security Update for Broadcom RabbitMQ

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with
    RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize,
    frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and
    ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both
    zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and
    disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle
    attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized
    frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level
    validation and potentially terminate the client process through memory exhaustion. This issue is fixed in
    version 5.34.0. (CVE-2026-75516)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with     RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize,     frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and     ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both     zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and     disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle     attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized     frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level     validation and potentially terminate the client process through memory exhaustion. This issue is fixed in     version 5.34.0. (CVE-2026-75516)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460711	Echo: com.rabbitmq:amqp-client: security update to 5.34.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460711	Echo: com.rabbitmq:amqp-client: security update to 5.34.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
346961	Linux Distros Unpatched Vulnerability : CVE-2026-75516	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-75516

high

Tenable Plugins

Coming Soon

high

high

high