The RabbitMQ Java client library versions before 5.33.1 contain an uncontrolled recursion vulnerability in src/main/java/com/rabbitmq/client/impl/ValueReader.java. Specifically, the methods ValueReader.readTable and ValueReader.readArray recursively call ValueReader.readFieldValue for AMQP table type F and array type A values without limiting nesting depth. A malicious AMQP server or network intermediary can exploit this by sending approximately 580 nested table levels within the pre-authentication connection.start frame, which fits within the default 131072-byte frame size. This triggers a StackOverflowError, terminating the client input processing thread and causing a denial of service. The vulnerability is addressed in version 5.33.1.

Exploitation of this vulnerability results in a denial of service condition on the RabbitMQ Java client by causing a StackOverflowError that terminates the client input processing thread. This can disrupt applications relying on the client to communicate with RabbitMQ nodes. There is no indication of privilege escalation, data disclosure, or code execution. The attack can be performed remotely without authentication.

This vulnerability is fixed in RabbitMQ Java client version 5.33.1. Users should upgrade to version 5.33.1 or later to remediate the issue. No other mitigation or workaround is indicated in the available data.