{"cve":"CVE-2023-46120","nvd":{"published":"2023-10-25T18:17:36.257","modified":"2026-06-17T06:30:11.487","status":"Modified","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects.  Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from  DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8","https://github.com/rabbitmq/rabbitmq-java-client/issues/1062","https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0","https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h","https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8"],"products":["vmware:rabbitmq_java_client"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-46120","score":0.01336,"percentile":0.71217,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-mm8h-8587-p46h","url":"https://osv.dev/vulnerability/GHSA-mm8h-8587-p46h","summary":"RabbitMQ Java client's Lack of Message Size Limitation leads to Remote DoS Attack","modified":"2026-09-10T03:50:03.942059951Z","packages":[{"ecosystem":"Maven","name":"com.rabbitmq:amqp-client","purl":"pkg:maven/com.rabbitmq/amqp-client","ranges":["<5.18.0"],"fixed":["5.18.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}