Medium severity4.9NVD Advisory· Published Oct 25, 2023· Updated Jun 17, 2026
CVE-2023-46120
CVE-2023-46120
Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.rabbitmq:amqp-clientMaven | < 5.18.0 | 5.18.0 |
Affected products
127- osv-coords125 versionspkg:apk/chainguard/apache-nifipkg:apk/chainguard/apache-nifi-compatpkg:apk/chainguard/apache-nifi-toolkitpkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/trinopkg:apk/chainguard/trino-configpkg:apk/chainguard/trino-oci-entrypointpkg:apk/chainguard/trino-plugin-ai-functionspkg:apk/chainguard/trino-plugin-bigquerypkg:apk/chainguard/trino-plugin-blackholepkg:apk/chainguard/trino-plugin-cassandrapkg:apk/chainguard/trino-plugin-clickhousepkg:apk/chainguard/trino-plugin-delta-lakepkg:apk/chainguard/trino-plugin-druidpkg:apk/chainguard/trino-plugin-duckdbpkg:apk/chainguard/trino-plugin-elasticsearchpkg:apk/chainguard/trino-plugin-exasolpkg:apk/chainguard/trino-plugin-exchange-filesystempkg:apk/chainguard/trino-plugin-exchange-hdfspkg:apk/chainguard/trino-plugin-fakerpkg:apk/chainguard/trino-plugin-functions-pythonpkg:apk/chainguard/trino-plugin-geospatialpkg:apk/chainguard/trino-plugin-google-sheetspkg:apk/chainguard/trino-plugin-hivepkg:apk/chainguard/trino-plugin-http-event-listenerpkg:apk/chainguard/trino-plugin-hudipkg:apk/chainguard/trino-plugin-icebergpkg:apk/chainguard/trino-plugin-ignitepkg:apk/chainguard/trino-plugin-jmxpkg:apk/chainguard/trino-plugin-kafkapkg:apk/chainguard/trino-plugin-kafka-event-listenerpkg:apk/chainguard/trino-plugin-lakehousepkg:apk/chainguard/trino-plugin-ldap-group-providerpkg:apk/chainguard/trino-plugin-lokipkg:apk/chainguard/trino-plugin-mariadbpkg:apk/chainguard/trino-plugin-memorypkg:apk/chainguard/trino-plugin-mlpkg:apk/chainguard/trino-plugin-mongodbpkg:apk/chainguard/trino-plugin-mysqlpkg:apk/chainguard/trino-plugin-mysql-event-listenerpkg:apk/chainguard/trino-plugin-opapkg:apk/chainguard/trino-plugin-openlineagepkg:apk/chainguard/trino-plugin-opensearchpkg:apk/chainguard/trino-plugin-oraclepkg:apk/chainguard/trino-plugin-password-authenticatorspkg:apk/chainguard/trino-plugin-pinotpkg:apk/chainguard/trino-plugin-postgresqlpkg:apk/chainguard/trino-plugin-prometheuspkg:apk/chainguard/trino-plugin-rangerpkg:apk/chainguard/trino-plugin-redispkg:apk/chainguard/trino-plugin-redshiftpkg:apk/chainguard/trino-plugin-resource-group-managerspkg:apk/chainguard/trino-plugin-session-property-managerspkg:apk/chainguard/trino-plugin-singlestorepkg:apk/chainguard/trino-plugin-snowflakepkg:apk/chainguard/trino-plugin-spooling-filesystempkg:apk/chainguard/trino-plugin-sqlserverpkg:apk/chainguard/trino-plugin-teradata-functionspkg:apk/chainguard/trino-plugin-thriftpkg:apk/chainguard/trino-plugin-tpcdspkg:apk/chainguard/trino-plugin-tpchpkg:apk/chainguard/trino-plugin-verticapkg:apk/wolfi/apache-nifipkg:apk/wolfi/apache-nifi-compatpkg:apk/wolfi/apache-nifi-toolkitpkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/trinopkg:apk/wolfi/trino-configpkg:apk/wolfi/trino-oci-entrypointpkg:apk/wolfi/trino-plugin-ai-functionspkg:apk/wolfi/trino-plugin-bigquerypkg:apk/wolfi/trino-plugin-blackholepkg:apk/wolfi/trino-plugin-cassandrapkg:apk/wolfi/trino-plugin-clickhousepkg:apk/wolfi/trino-plugin-delta-lakepkg:apk/wolfi/trino-plugin-druidpkg:apk/wolfi/trino-plugin-duckdbpkg:apk/wolfi/trino-plugin-elasticsearchpkg:apk/wolfi/trino-plugin-exasolpkg:apk/wolfi/trino-plugin-exchange-filesystempkg:apk/wolfi/trino-plugin-exchange-hdfspkg:apk/wolfi/trino-plugin-fakerpkg:apk/wolfi/trino-plugin-functions-pythonpkg:apk/wolfi/trino-plugin-geospatialpkg:apk/wolfi/trino-plugin-google-sheetspkg:apk/wolfi/trino-plugin-hivepkg:apk/wolfi/trino-plugin-http-event-listenerpkg:apk/wolfi/trino-plugin-hudipkg:apk/wolfi/trino-plugin-icebergpkg:apk/wolfi/trino-plugin-ignitepkg:apk/wolfi/trino-plugin-jmxpkg:apk/wolfi/trino-plugin-kafkapkg:apk/wolfi/trino-plugin-kafka-event-listenerpkg:apk/wolfi/trino-plugin-lakehousepkg:apk/wolfi/trino-plugin-ldap-group-providerpkg:apk/wolfi/trino-plugin-lokipkg:apk/wolfi/trino-plugin-mariadbpkg:apk/wolfi/trino-plugin-memorypkg:apk/wolfi/trino-plugin-mlpkg:apk/wolfi/trino-plugin-mongodbpkg:apk/wolfi/trino-plugin-mysqlpkg:apk/wolfi/trino-plugin-mysql-event-listenerpkg:apk/wolfi/trino-plugin-opapkg:apk/wolfi/trino-plugin-openlineagepkg:apk/wolfi/trino-plugin-opensearchpkg:apk/wolfi/trino-plugin-oraclepkg:apk/wolfi/trino-plugin-password-authenticatorspkg:apk/wolfi/trino-plugin-pinotpkg:apk/wolfi/trino-plugin-postgresqlpkg:apk/wolfi/trino-plugin-prometheuspkg:apk/wolfi/trino-plugin-rangerpkg:apk/wolfi/trino-plugin-redispkg:apk/wolfi/trino-plugin-redshiftpkg:apk/wolfi/trino-plugin-resource-group-managerspkg:apk/wolfi/trino-plugin-session-property-managerspkg:apk/wolfi/trino-plugin-singlestorepkg:apk/wolfi/trino-plugin-snowflakepkg:apk/wolfi/trino-plugin-spooling-filesystempkg:apk/wolfi/trino-plugin-sqlserverpkg:apk/wolfi/trino-plugin-teradata-functionspkg:apk/wolfi/trino-plugin-thriftpkg:apk/wolfi/trino-plugin-tpcdspkg:apk/wolfi/trino-plugin-tpchpkg:apk/wolfi/trino-plugin-verticapkg:maven/com.rabbitmq/amqp-client
< 2.6.0-r2+ 124 more
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 4.0.1-r1
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 2.6.0-r2
- (no CPE)range: < 4.0.1-r1
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 478-r2
- (no CPE)range: < 5.18.0
- Range: < 5.18.0
Patches
Vulnerability mechanics
References
6- github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8nvdPatchWEB
- github.com/rabbitmq/rabbitmq-java-client/issues/1062nvdIssue TrackingPatchWEB
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46hnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-mm8h-8587-p46hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-46120ghsaADVISORY
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.