CVE-2026-75516
Description
A flaw was found in the RabbitMQ Java client. A malicious AMQP (Advanced Message Queuing Protocol) server, or a man-in-the-middle attacker, can modify connection parameters and inject oversized frames. This can cause the client to allocate a large amount of memory, leading to memory exhaustion and potentially terminating the client process. This vulnerability results in a Denial of Service (DoS) for applications using the client library.
Statement
This vulnerability is rated as Important because an attacker capable of intercepting network traffic or operating a rogue message broker can remotely crash client applications through unbounded memory consumption, causing a complete denial of service. In typical Red Hat deployments, applications establish connections to centralized message brokers, where default negotiation settings disable the internal frame size limits intended to safeguard the JVM. As a result, a single oversized protocol payload can exhaust available heap space before data validation, though the flaw cannot be leveraged to compromise confidentiality or system integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
