THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-jh4v-gfqj-7rhx (high) — RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

[GHSA] GHSA-jh4v-gfqj-7rhx (high) — RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

medgithub_advisoriesPublished 2026-09-17

GHSA-jh4v-gfqj-7rhx Severity: high CVE: CVE-2026-75516

RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

## Vulnerability

In `AMQConnection.java` (line 435-436), after `Connection.Tune` negotiation, the frame-max limit is set via:

```java _frameHandler.setFrameMax( Math.min(this.maxInboundMessageBodySize, frameMax)); ```

When `

Indicators of compromise

Original source: https://github.com/advisories/GHSA-jh4v-gfqj-7rhx