Summary
RocketMQ-Client-CPP is the C/C++ client of Apache RocketMQ, a distributed messaging and streaming platform with low latency, high performance and reliability, trillion-level capacity and flexible scalability.
Description
Apache RocketMQ Client C++ suffers from a remote out-of-bounds read vulnerability in its RemotingCommand decoder. The wire header length is used to compute a parse boundary without validating it against the actual received buffer size, so a malicious or MitM broker or nameserver can send a crafted frame that causes a large heap over-read. This allows a peer to crash the client (DoS).
RemotingCommand* RemotingCommand::Decode(const MemoryBlock& mem) {
uint32 messageHeader[1];
mem.copyTo(messageHeader, 0, sizeof(messageHeader)); // first 4 bytes of the frame
int totalLen = mem.getSize(); // actual bytes received
int headLen = ntohl(messageHeader[0]); // attacker-controlled, not validated
int bodyLen = totalLen - 4 - headLen;
const char* const pData = static_cast<const char*>(mem.getData());
const char* begin = pData + 4;
const char* end = pData + 4 + headLen; // end can point far past the buffer
if (!reader.parse(begin, end, object)) { ... } // JSON parse over: OOB read
Disclosure Timeline
13.08.2026Vulnerability discovered.
19.08.2026Contact with the vendor.
20.08.2026Vendor forwards details to appropriate PMC.
23.10.2026No response from the vendor.
24.10.2026Public security advisory released.