Skip to content
OpenAdvisories

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

Affected products

VendorProductAffectedFixed
rabbitmq rabbitmq-java-client < 5.36.1 —
com.rabbitmq amqp-client < 5.36.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 rabbitmq-java-client No fix yet —
Debian 12 rabbitmq-java-client No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rabbitmq-java-client No fix yet —
Ubuntu 26.04 LTS rabbitmq-java-client No fix yet —
Ubuntu 24.04 LTS rabbitmq-java-client No fix yet —
Ubuntu 22.04 LTS rabbitmq-java-client No fix yet —
Ubuntu 20.04 LTS rabbitmq-java-client No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS rabbitmq-java-client No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cassandra-reaper 5.0.1-r9 —
Wolfi rolling druid 38.0.0-r4 —
Wolfi rolling logstash-9.3 +1 No fix yet —
Wolfi rolling logstash-9.4 +1 9.4.7-r8 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.5-r7 —
Wolfi rolling zipkin 3.6.1-r39 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.rabbitmq:amqp-client < 5.36.1 5.36.1 GHSA-cqgh-8p3p-mx4m

Advisories 1

References