[ CVE-2026-106121 · Published 6 Oct 2026 ]

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

CVSS 7.5 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

[ Fixes ]Fixes and patches

com.rabbitmq:amqp-client 5.36.1Fixed version · GitHub Advisories · maven package com.rabbitmq:amqp-client: upgrade to 5.36.1 or later (affected <= 5.36.0)
Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

BSI CERT-Bund6 Oct 2026WID-SEC-2026-3773

RabbitMQ Java Client: Multiple vulnerabilities Translated from German
CVE-2026-106123CVE-2026-106122CVE-2026-106121

[ Packages ]Affected open-source packages

com.rabbitmq:amqp-client mavenAffected <= 5.36.0 · fixed in 5.36.1 · GHSA-cqgh-8p3p-mx4m

[ Why it matters ]Priority signals

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

RabbitMQ Java Client: Multiple vulnerabilities Translated from German

[ Packages ]Affected open-source packages

[ References ]References