Skip to content
OpenAdvisories
Medium WID-SEC-2026-3773 3 CVEs

RabbitMQ Java Client: Mehrere Schwachstellen

Published Oct 6, 2026 · Updated Oct 6, 2026 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im RabbitMQ Java Client ausnutzen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.

Product

RabbitMQ ist ein Open-Source Message Broker.

Vulnerabilities 3

  • Medium 6.0
    CVE-2026-106122

    RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shor…

    rabbitmq com.rabbitmq rabbitmq-java-client amqp-client Debian Ubuntu Wolfi Maven
  • Medium 5.7
    CVE-2026-106123

    RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because…

    rabbitmq com.rabbitmq rabbitmq-java-client amqp-client Debian Ubuntu Wolfi Maven
  • Medium 4.9
    CVE-2026-106121

    RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

    The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment beca…

    rabbitmq com.rabbitmq rabbitmq-java-client amqp-client Debian Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References