Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

• Apache Pony Mail
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the inbound frame size handling in AMQConnection.java. An attacker can trigger excessive frame allocation and crash the client by negotiating frame_max=0 and then sending an oversized AMQP frame. The vulnerable code derives the inbound frame payload limit with Math.min(this.maxInboundMessageBodySize, frameMax), so a negotiated zero-valued frameMax is treated as a literal limit of 0 and defeats the configured inbound cap. Because frame.readFrom() allocates based on that effective limit, a malicious broker or MITM can force the client to accept a huge frame and exhaust memory during connection processing.

Remediation

Upgrade com.rabbitmq:amqp-client to version 5.34.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR

Overview

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the readBytes() method in src/main/java/com/rabbitmq/client/impl/ValueReader.java. An attacker can trigger a JVM OutOfMemoryError by sending an AMQP field or long string with a declared length that causes the reader to allocate a byte array before verifying that the frame actually contains that many bytes. The vulnerable code trusts the wire length prefix and creates new byte[(int)contentLength] for any value below Integer.MAX_VALUE. A malicious peer can supply a near-2GB length and crash the client process before readFully() can reject the frame.

Remediation

Upgrade com.rabbitmq:amqp-client to version 5.33.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion in ValueReader table and array parsing. An attacker can crash the client JVM by sending a deeply nested AMQP field value, such as a connection.start frame containing recursively nested tables or arrays. The issue lives in src/main/java/com/rabbitmq/client/impl/ValueReader.java, where readTable() and readArray() recurse through readFieldValue() without any nesting limit. A malicious AMQP peer can trigger a StackOverflowError, killing the client’s I/O thread and causing a denial of service.

Remediation

Upgrade com.rabbitmq:amqp-client to version 5.33.1 or higher.

References

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypass enforced safety checks by submitting specially crafted expressions for evaluation.

Note: This is only exploitable if the application evaluates SpEL expressions using SimpleEvaluationContext and the SpEL expression compiler is active via the spring.expression.compiler.mode property or a SpelParserConfiguration set to IMMEDIATE or MIXED.

Remediation

Upgrade org.springframework:spring-expression to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the evaluation of user-supplied SpEL expressions containing the power operator (^) with a BigDecimal or BigInteger operand and a large exponent value. An attacker can cause excessive CPU and memory consumption by submitting specially crafted expressions.

Note: This is only exploitable if the application accepts and evaluates untrusted SpEL expressions and a BigDecimal or BigInteger value is accessible within the evaluation context.

Remediation

Upgrade org.springframework:spring-expression to version 7.0.9 or higher.

References

• Spring Security Advisory

Overview

Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') via ProcedureDescription.computeReturnTypeAsJavaClass() in src/main/java/com/rabbitmq/tools/jsonrpc/ProcedureDescription.java. An attacker can trigger loading of attacker-chosen classes by sending a crafted JSON-RPC javaReturnType value in a system.describe response. Because the client resolves that field with Class.forName(javaReturnType) on data taken from an untrusted AMQP message, classes on the victim’s classpath are loaded with static initialization enabled. That can execute attacker-selected static initializers in the client JVM and disrupt or influence applications using the JSON-RPC tools.

Remediation

Upgrade com.rabbitmq:amqp-client to version 5.33.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• Maintainer's Advisory

Overview

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the DnsResolveContext.AuthoritativeNameServerList#add function. An attacker can inject malicious NS and A records into the DNS cache by controlling an authoritative name server for a subdomain and providing NS records that claim authority over a parent domain, leading to unauthorized redirection or interception of DNS queries for affected domains.

Remediation

Upgrade io.netty:netty-resolver-dns to version 4.1.135.Final, 4.2.15.Final or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release
• GitHub Release

Overview

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to missing validation of the origin of CNAME records in DNS responses within the DnsResolveContext function. An attacker can inject unauthorized DNS records by supplying malicious DNS responses, potentially leading to cache poisoning and redirection of network traffic.

Remediation

Upgrade io.netty:netty-resolver-dns to version 4.1.135.Final, 4.2.15.Final or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Release
• GitHub Release