Detections
Analytics

Echo: com.rabbitmq:amqp-client: security update to 5.34.0

high Tenable Cloud Security Plugin ID 460711

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with
 RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize,
 frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and
 ConnectionFactory.DEFAULT_FRAME_MAX is zero. When the client default and server-negotiated value are both
 zero, the result is passed to Utils.framePayloadLimit(int), which interprets zero as Integer.MAX_VALUE and
 disables the configured maxInboundMessageBodySize cap. A malicious AMQP server, or a man-in-the-middle
 attacker able to modify Connection.Tune and inject frames into the connection, can then send an oversized
 frame of any frame type, causing Frame.readFrom() to allocate a large byte array before content-level
 validation and potentially terminate the client process through memory exhaustion. This issue is fixed in
 version 5.34.0. (CVE-2026-75516)

Solution

Update the com.rabbitmq:amqp-client library and its related packages to version 5.34.0 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-75516

Plugin Details

Severity: High

ID: 460711

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.42

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-75516

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/28/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-75516