CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Attackers can cause a remote denial of service by sending large messages that exhaust memory in applications using the RabbitMQ Java client.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46120?
CVE-2023-46120 is a medium-severity denial of service vulnerability in rabbitmq-java-client, published on 24 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.
Weakness: CWE-400
Which versions are affected by CVE-2023-46120?
2 open source packages ship an affected version, including com.rabbitmq:amqp-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.rabbitmq:amqp-client Maven | All versions | 5.18.0 |
com.rabbitmq:amqp-client Maven | All versions | 5.18.0 |
Products include Vmware Rabbitmq Java Client.
How do I fix CVE-2023-46120?
Upgrade com.rabbitmq:amqp-client to 5.18.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46120 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46120 exists.
Other vulnerabilities in rabbitmq-java-client
- CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
- CVE-2026-106123 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
- CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Sources
Also known as CLEANSTART-2026-RJ60135, CLEANSTART-2026-YW63019, DEBIAN-CVE-2023-46120, GHSA-mm8h-8587-p46h, MINI-pvmq-gr7x-fjp6, UBUNTU-CVE-2023-46120 and 1 more.