CVE-2026-63335

### Summary RabbitMQ Java Client's inbound AMQP command assembly accepts a content header declaring a small body and then processes a larger body frame by throwing a raw `UnsupportedOperationException` from `CommandAssembler`. A broker peer that the client has connected to can use this malformed frame sequence to fail frame processing and tear down the client connection instead of receiving a clean protocol-level malformed-frame error. This was discovered based on an existing vulnerability CVE-2017-15699. ### Details Inbound frames enter the client through `SocketFrameHandler.readFrame`, which returns frames parsed from the peer-controlled input stream (`src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java:197`). `AMQConnection.MainLoop` reads each frame (`src/main/java/com/rabbitmq/client/impl/AMQConnection.java:692`) and dispatches non-zero-channel frames to the channel while the connection is open (`src/main/java/com/rabbitmq/client/impl/AMQConnection.java:748` and `src/main/java/com/rabbitmq/client/impl/AMQConnection.java:766`). The channel then passes the frame to the current command assembler through `AMQChannel.handleFrame` and `AMQCommand.handleFrame` (`src/main/java/com/rabbitmq/client/impl/AMQChannel.java:121`, `src/main/java/com/rabbitmq/client/impl/AMQCommand.java:114`). When a content-bearing method is followed by a content header, `CommandAssembler.consumeHeaderFrame` records the header's declared body size in `remainingBodyBytes` after only checking it against the configured maximum (`src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:126` through `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:139`). The body-frame path subtracts the received payload length from that remaining count before validating that the payload fits (`src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:145` through `src/main/java/com/rabbitmq/client/impl/CommandAssembler.java:149`), so a body frame larger than the declared size driv