Read the docs
TI-2026-68640 Aliases CVE-2026-106121GHSA-cqgh-8p3p-mx4m

RabbitMQ Java client JSON parser hangs on truncated input

Priority HIGH 66CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

The RabbitMQ Java client (com.rabbitmq:amqp-client) before 5.36.1 contains a loop with an unreachable exit condition (CWE-835) in its JSON reader, which the default JSON-RPC mapper uses for message bodies. Truncated input ending inside a quoted string or a line comment keeps the parser running, exhausting heap or consuming CPU. A remote attacker who can send JSON-RPC messages to an affected server or client can cause denial of service. A proof-of-concept exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00533 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rabbitmq-java-client (rabbitmq): 5.36.1amqp-client (com.rabbitmq): 5.36.1+1 more productRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-java-clientbefore 5.36.15.36.1Patch availableCNA
VMwareamqp-clientbefore 5.36.15.36.1Patch availableCNA
—com.rabbitmq:amqp-client (Maven)before 5.36.15.36.1Patch availableGHSA-cqgh-8p3p-mx4m
  • rabbitmq-java-client Vendorrabbitmq Affected before 5.36.1 Fixed in 5.36.1 Patch available CNA
  • amqp-client VendorVMware Affected before 5.36.1 Fixed in 5.36.1 Patch available CNA
  • com.rabbitmq:amqp-client (Maven) Vendor— Affected before 5.36.1 Fixed in 5.36.1 Patch available GHSA-cqgh-8p3p-mx4m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*before 5.37.0VulnerableVMware
  • cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:* Versions before 5.37.0 Vulnerable ·VMware

Remediation

Upgrade rabbitmq-java-client and com.rabbitmq amqp-client to version 5.36.1, which fixes the flaw for Maven com.rabbitmq:amqp-client. The sources list no fixed version for Red Hat Fuse 7 (no fix planned) or for Red Hat build of Apache Camel 4 for Quarkus 3 (none available).

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA rabbitmq-java-client (rabbitmq) Fixed in 5.36.1
  • Fix · CNA amqp-client (com.rabbitmq) Fixed in 5.36.1
  • Fix · GHSA-cqgh-8p3p-mx4m com.rabbitmq:amqp-client (Maven) Fixed in 5.36.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106121
  2. 2026-10-07 Alias added: GHSA-cqgh-8p3p-mx4m
  3. 2026-10-07 Fix available: Maven/com.rabbitmq:[email protected] · GHSA-cqgh-8p3p-mx4m
  4. 2026-10-07 CVSS score added · GHSA-cqgh-8p3p-mx4m
  5. 2026-10-07 Weakness changed · GHSA-cqgh-8p3p-mx4m
  6. 2026-10-07 6 new references · GHSA-cqgh-8p3p-mx4m
  7. 2026-10-09 CVSS score added · NVD
  8. 2026-10-10 Priority changed: MEDIUM → HIGH
  9. 2026-11-03 Affected versions changed · Red Hat
  10. 2026-11-03 CVSS score added · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences