The RabbitMQ Java client library versions before 5.31.0 improperly validate inbound AMQP command frames in CommandAssembler.java. Specifically, when processing a content-bearing method and header, the remainingBodyBytes value can become negative due to subtracting a peer-controlled payload length before validation. This leads to an UnsupportedOperationException being thrown instead of the expected MalformedFrameException. A malicious or compromised broker can exploit this by sending a malformed frame sequence on an open nonzero channel, causing the client to terminate frame processing and close the connection, resulting in denial of service.

A malicious or compromised RabbitMQ broker can send malformed AMQP frames that cause the client connection to close unexpectedly. This leads to denial of service for applications relying on the affected rabbitmq-java-client versions prior to 5.31.0. There is no indication of privilege escalation, data corruption, or remote code execution from this vulnerability.

This vulnerability is fixed in rabbitmq-java-client version 5.31.0. Users should upgrade to version 5.31.0 or later to remediate this issue. No other mitigations or workarounds are indicated.