CVE-2020-27217

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.

• CWE-1284

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=567068Issue Tracking, Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=567068Issue Tracking, Vendor Advisory

Published

Nov 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27209The ECDSA operation of the micro-ecc library 1.0 is vulnerab…7.5
• CVE-2020-2721Vulnerability in the Oracle FLEXCUBE Investor Servicing prod…6.5
• CVE-2020-27211Nordic Semiconductor nRF52840 devices through 2020-10-19 hav…5.7
• CVE-2020-27212STMicroelectronics STM32L4 devices through 2020-10-19 have i…7
• CVE-2020-27213An issue was discovered in Ethernut Nut/OS 5.1. The code tha…7.5
• CVE-2020-27216In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.…7
• CVE-2020-27218In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0…4.8
• CVE-2020-27219In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP…6.1
• CVE-2020-2722Vulnerability in the Oracle FLEXCUBE Investor Servicing prod…5.4
• CVE-2020-27220The Eclipse Hono AMQP and MQTT protocol adapters do not chec…8.8
• CVE-2020-27221In Eclipse OpenJ9 up to and including version 0.23, there is…9.8
• CVE-2020-27222In Eclipse Californium version 2.3.0 to 2.6.0, the certifica…7.5