Skip to content
OpenAdvisories
Medium WID-SEC-2026-2921 6 CVEs

RabbitMQ Java Client: Mehrere Schwachstellen

Published Aug 18, 2026 · Updated Aug 18, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen im RabbitMQ Java Client ausnutzen, um Code auszuführen, um Sicherheitsmechanismen zu umgehen und um einen Denial of Service herbeizuführen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 6

  • High 8.7
    CVE-2026-69219

    RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength…

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-69220

    RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call Va…

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-63337

    RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response a…

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2026-63335

    RabbitMQ Java client malformed body frame triggers raw command assembler exception

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing …

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.1
    CVE-2026-63336

    RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq…

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • None 0.0
    CVE-2026-61634

    RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/So…

    rabbitmq rabbitmq-java-client druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References