Cybersecurity articles

## Summary The max body size was enforced to patch CVE-2023-46120, but even though that limit still works, the frame size itself still exceeds the given max size. ## Root cause The Java client records the AMQP 0-9-1 `frame_max` negotiated during connection tuning, but the socket inbound frame rea...

The JSON-RPC tools in `com.rabbitmq.tools.jsonrpc` perform `Class.forName(javaReturnType)` with `initialize=true` on class names received from untrusted AMQP messages, without any validation or allowlist. **Vulnerable code** (`ProcedureDescription.java:101-127`): When a `JsonRpcClient` connects, ...

Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an atta...