Read the docs
TI-2026-68641 Aliases CVE-2026-106122GHSA-7822-rcf6-97fx

Malformed UTF-8 in RabbitMQ Java client permanently disables RPC consumers

Priority MEDIUM 60CWE-172Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

Versions of the RabbitMQ Java client before 5.36.0 are affected. ValueReader.readShortstr decodes malformed UTF-8 into replacement characters that can grow beyond the AMQP shortstr length limit (CWE-172). An attacker who can submit an RPC message with a malformed echoed property makes reply publication throw an unchecked exception, so the message is requeued and blocks consumers until the queue is purged. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rabbitmq-java-client (rabbitmq): 5.36.0amqp-client (com.rabbitmq): 5.36.0+1 more productRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-java-clientbefore 5.36.05.36.0Patch availableCNA
VMwareamqp-clientbefore 5.36.05.36.0Patch availableCNA
—com.rabbitmq:amqp-client (Maven)before 5.36.05.36.0Patch availableGHSA-7822-rcf6-97fx
  • rabbitmq-java-client Vendorrabbitmq Affected before 5.36.0 Fixed in 5.36.0 Patch available CNA
  • amqp-client VendorVMware Affected before 5.36.0 Fixed in 5.36.0 Patch available CNA
  • com.rabbitmq:amqp-client (Maven) Vendor— Affected before 5.36.0 Fixed in 5.36.0 Patch available GHSA-7822-rcf6-97fx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*before 5.36.0VulnerableVMware
  • cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:* Versions before 5.36.0 Vulnerable ·VMware

Remediation

Upgrade the RabbitMQ Java client and com.rabbitmq:amqp-client to version 5.36.0. Red Hat Fuse 7 has no fix planned, and the Red Hat build of Apache Camel 4 for Quarkus 3 has none available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA rabbitmq-java-client (rabbitmq) Fixed in 5.36.0
  • Fix · CNA amqp-client (com.rabbitmq) Fixed in 5.36.0
  • Fix · GHSA-7822-rcf6-97fx com.rabbitmq:amqp-client (Maven) Fixed in 5.36.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106122
  2. 2026-10-07 Alias added: GHSA-7822-rcf6-97fx
  3. 2026-10-07 Fix available: Maven/com.rabbitmq:[email protected] · GHSA-7822-rcf6-97fx
  4. 2026-10-07 CVSS score added · GHSA-7822-rcf6-97fx
  5. 2026-10-07 Weakness changed · GHSA-7822-rcf6-97fx
  6. 2026-10-07 6 new references · GHSA-7822-rcf6-97fx
  7. 2026-10-09 CVSS score added · NVD
  8. 2026-11-03 Affected versions changed · Red Hat
  9. 2026-11-03 CVSS score added · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences