CVE-2023-46120

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461213.7yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbi CVE-2023-461227.1sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. Thi CVE-2023-461235.3jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specificati CVE-2023-461247.2Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the CVE-2023-461256.5Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the CVE-2023-461265.4Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping CVE-2023-461275.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A ma CVE-2023-461286.5Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. I CVE-2023-461297.5NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge compu CVE-2023-46139.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461305.4Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-461317.5Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM