CVE-2026-75516
HighAdvisory
Published 17 Sept 2026In the index since 18 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.005
- 44th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 79
- of 17,813 indexed, latest versions
- Container images
- 93
- deployed by those charts
- Fix available
- 1 of 1
- affected package
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement
Carried by container images the latest versions of 79 of 17,813 indexed charts deploy, on 93 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| amqp-clientmaven | 4.8.0, 4.11.3, 4.12.0, 5.0.0+22 more | 5.34.0 | 93 |
- OSV records
- GHSA-jh4v-gfqj-7rhx
Charts affected
79 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| graylogkong-zVerified publisher | 3.0.33 | 1 of 5See more | 2,835 |
| zipkincarlosjgp | 0.2.0 | 1 of 2See more | 3,252 |
| apim3graviteeioVerified publisher | 4.12.19 | 2 of 4See more | 5,002 |
| druiddruid-helmVerified publisher | 37.0.2 | 1 of 3See more | 3,923 |
| grayloggroundhog2k | 0.13.10 | 1 of 1See more | 1,157 |
| grayloggraylog2OfficialVerified publisher | 2.0.0 | 1 of 2See more | 1,584 |
| druidwiremindVerified publisher | 1.22.1 | 1 of 3See more | 8,043 |
| zipkinygqygq2Verified publisher | 2.1.4 | 1 of 4See more | 2,788 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 10,712 |
| geoservercloudcamptocamp2 | 3.0.1 | 6 of 7See more | 11,457 |
| thingsboardcetic | 0.1.2 | 1 of 2See more | 5,358 |
| flowableflowable-oss | 7.1.0 | 1 of 2See more | 2,817 |
| apimgraviteeioVerified publisher | 4.12.19 | 2 of 4See more | 5,002 |
| oesopsmxVerified publisher | 4.0.32 | 1 of 25See more | 101,186 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,671 |
| migrationadeptia-connect-migrationVerified publisher | 4.8.1 | 1 of 1See more | 501 |
| geoserver-cloudcamptocamp2 | 0.0.5 | 5 of 11See more | 84,845 |
| geoserverCloudcamptocamp2 | 0.0.6 | 5 of 11See more | 84,845 |
| paraerudikaVerified publisher | 0.3.0 | 1 of 1See more | 1,195 |
| pitchforkexpediagroup | 0.1.4 | 1 of 1See more | 3,328 |
| traccarjeffrescVerified publisher | 0.2.0 | 1 of 2See more | 1,512 |
| auditflowlabs64io-helm-chartsVerified publisher | 0.15.0 | 1 of 3See more | 1,532 |
| Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher | 1.0.1 | 1 of 6See more | 19,235 |
| reportportalreportportal-ioOfficialVerified publisher | 26.8.12 | 3 of 15See more | 12,320 |
| logstashromanow-helm-chartsVerified publisher | 1.5.0 | 1 of 1See more | 7,607 |
| graylogt3n | 1.0.0 | 1 of 3See more | 8,081 |
| migrationadeptia-automate-migration | 5.2.9 | 1 of 1See more | 445 |
| d.vazquezm.2021_helmapphelmVerified publisher | 1.0.0 | 1 of 6See more | 19,830 |
| inbox-serverappscodeVerified publisher | 2025.12.25 | 1 of 1See more | 4,073 |
| inbox-server-distributedappscodeVerified publisher | 2025.12.25 | 1 of 4See more | 15,894 |
| james-komposeappscodeVerified publisher | 0.1.0 | 1 of 4See more | 17,276 |
| chart-app-vidapp-vid-chartVerified publisher | 0.0.7 | 1 of 2See more | 8,937 |
| blackduck-alertblackduck | 8.4.0 | 1 of 4See more | 4,329 |
| geoservercamptocamp2 | 0.0.3 | 5 of 12See more | 88,806 |
| consumer-helmconsumer-app-helm-chart | 0.1.0 | 1 of 1See more | 2,568 |
| eoloplannerdfa-amm-eoloplannerVerified publisher | 0.1.0 | 1 of 7See more | 27,736 |
| elk-stackelk-stack-test | 1.0.2 | 1 of 9See more | 3,177 |
| eolicplantseolicplantsVerified publisher | 0.1.0 | 1 of 7See more | 27,477 |
| eoloPlanteolo-plannerVerified publisher | 0.1.0 | 2 of 7See more | 27,879 |
| eoloplannereoloplannerVerified publisher | 0.1.0 | 2 of 7See more | 32,551 |
| eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher | 0.1.0 | 2 of 7See more | 27,879 |
| eoloplanner-mcaeoloplanner-mcaVerified publisher | 0.1.0 | 1 of 7See more | 27,442 |
| eoloplannereoloplanner-molynx-gat | 0.1.0 | 2 of 7See more | 28,667 |
| eolo-plannereolo-planner-repo | 0.1.0 | 1 of 7See more | 27,302 |
| eoloplanteoloplant | 1.0.0 | 2 of 7See more | 27,879 |
| eoloplantseoloplants-urjcVerified publisher | 0.1.0 | 2 of 7See more | 27,941 |
| servereoloserverVerified publisher | 0.1.0 | 2 of 7See more | 32,551 |
| findery-marketfindery-market | 0.1.0 | 1 of 7See more | 7,851 |
| grayloggraylogVerified publisher | 1.0.2 | 1 of 4See more | 5,411 |
| druidhelmforgeVerified publisher | 1.3.6 | 1 of 4See more | 8,791 |
Container images carrying it
93 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| hugohg34/ | 171f61e8d7e2 | amqp-client | 5.34.0 | 1 |
| j4ckhunter/ | bb7a429e3e75 | amqp-client | 5.34.0 | 1 |
| j4ckhunter/ | 6ba447609b12 | amqp-client | 5.34.0 | 1 |
| labs64/ | c7b26d3ca11c | amqp-client | 5.34.0 | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | amqp-client | 5.34.0 | 1 |
| lavandadelpatio/ | 92de3c3426d2 | amqp-client | 5.34.0 | 1 |
| lavandadelpatio/ | d2cba20aa4d8 | amqp-client | 5.34.0 | 1 |
| lavandadelpatio/ | ded9377636e9 | amqp-client | 5.34.0 | 1 |
| lavandadelpatio/ | f36af885e915 | amqp-client | 5.34.0 | 1 |
| library/ | 17a4f64e9cf5 | amqp-client | 5.34.0 | 1 |
| library/ | 33eae14f0867 | amqp-client | 5.34.0 | 1 |
| lourdesmorente/ | 608745878cdb | amqp-client | 5.34.0 | 1 |
| maksimkavalenka/ | 64a25afb8748 | amqp-client | 5.34.0 | 1 |
| maksimkavalenka/ | 13ad9bb170a0 | amqp-client | 5.34.0 | 1 |
| molynx/ | 441c9f52f092 | amqp-client | 5.34.0 | 1 |
| openbas/ | d986d80b0a75 | amqp-client | 5.34.0 | 1 |
| opensearchproject/ | 43b0cdaf26ed | amqp-client | 5.34.0 | 1 |
| openzipkin/ | 197a9692f6a9 | amqp-client | 5.34.0 | 1 |
| openzipkin/ | 60c3970df479 | amqp-client | 5.34.0 | 1 |
| openzipkin/ | b5d51d1144e2 | amqp-client | 5.34.0 | 1 |
| oscarsotosanchez/ | 730c00a099b8 | amqp-client | 5.34.0 | 1 |
| pcarrascoponce/ | 981fc482442c | amqp-client | 5.34.0 | 1 |
| reportportal/ | 9df41f8fb320 | amqp-client | 5.34.0 | 1 |
| reportportal/ | bf193091525a | amqp-client | 5.34.0 | 1 |
| reportportal/ | 6a954407b417 | amqp-client | 5.34.0 | 1 |
| reportportal/ | 99d27d58d6b4 | amqp-client | 5.34.0 | 1 |
| reportportal/ | dc166c58485a | amqp-client | 5.34.0 | 1 |
| slagattollas/ | cecd95e31486 | amqp-client | 5.34.0 | 1 |
| thingsboard/ | bd45a09d85d9 | amqp-client | 5.34.0 | 1 |
| thingsboard/ | a06f53c5e2da | amqp-client | 5.34.0 | 1 |
| thingsboard/ | 030f316ce301 | amqp-client | 5.34.0 | 1 |
| thingsboard/ | 645f43b688f7 | amqp-client | 5.34.0 | 1 |
| thingsboard/ | f40a542832c4 | amqp-client | 5.34.0 | 1 |
| thingsboard/ | 2d17e4e36edc | amqp-client | 5.34.0 | 1 |
| torrespro/ | 6d3bd305a1ba | amqp-client | 5.34.0 | 1 |
| traccar/ | 621c8d6d46fd | amqp-client | 5.34.0 | 1 |
| trinodb/ | ee80ab5eeab2 | amqp-client | 5.34.0 | 1 |
| vlebediantsev/ | 10393a89b4a8 | amqp-client | 5.34.0 | 1 |
| vlebediantsev/ | df8bf38c535b | amqp-client | 5.34.0 | 1 |
| ghcr.io/ | 4a2824296412 | amqp-client | 5.34.0 | 1 |
| ghcr.io/ | af724c855f65 | amqp-client | 5.34.0 | 1 |
| public.ecr.aws/ | e85f034bcf48 | amqp-client | 5.34.0 | 1 |
| quay.io/ | 2b3554029737 | amqp-client | 5.34.0 | 1 |