Rabbitmq Rabbitmq-Java-Client vulnerabilities

CVE-2026-69220 [HIGH] CWE-674 CVE-2026-69220: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively for AMQP table type F and AMQP array type A values withou

CVE-2026-69219 [HIGH] CWE-789 CVE-2026-69219: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the

CVE-2026-75516 [HIGH] CWE-770 CVE-2026-75516: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation even though AMQP defines frameMax value zero as unlimited and ConnectionFactory.DEFAULT_FRAME_MAX is zero.

CVE-2026-63337 [HIGH] CWE-470 CVE-2026-63337: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to

CVE-2026-106121 [HIGH] CWE-835 CVE-2026-106121: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default De

CVE-2026-63335 [MEDIUM] CWE-20 CVE-2026-63335: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose remainingBodyBytes value is smaller than a following AMQP.FRAME_BODY

CVE-2026-106122 [HIGH] CWE-172 CVE-2026-106122: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message

CVE-2023-46120 [HIGH] CWE-400 CVE-2023-46120: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client whi

CVE-2026-63336 [MEDIUM] CWE-295 CVE-2026-63336: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitr

CVE-2026-106123 [MEDIUM] CWE-209 CVE-2026-106123: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performa

CVE-2026-61634 [NONE] CWE-20 CVE-2026-61634: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame