The vulnerability in RabbitMQ's management HTTP API allows oversized valid JSON bodies to be accepted due to improper size validation in the read_complete_body function. Specifically, the function checks the accumulated size before the final chunk but fails to validate the final combined size, leading to acceptance of oversized payloads on the with_decode and direct_request API paths. This flaw affects RabbitMQ versions prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5 and has been addressed in these fixed versions.

The vulnerability could allow an attacker to send oversized JSON payloads to the management HTTP API, potentially leading to resource exhaustion or denial of service conditions. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability, suggesting the primary impact is on service availability.

A fix is available in RabbitMQ versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5. Users should upgrade to these or later versions to remediate the vulnerability. No vendor advisory indicating alternative mitigations or no action required is provided, so upgrading is the recommended remediation.