rabbitmq rabbitmq-java-client vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 202610

Newest CVEs

• CVE-2026-106123

  RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

  rabbitmq · rabbitmq-java-client

  Medium5.7
• CVE-2026-106122

  RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

  rabbitmq · rabbitmq-java-client

  Medium6.0
• CVE-2026-106121

  RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

  rabbitmq · rabbitmq-java-client

  Medium4.9
• CVE-2026-75516

  RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

  rabbitmq · rabbitmq-java-client

  High8.7
• CVE-2026-61634

  RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

  rabbitmq · rabbitmq-java-client

  None0.0
• CVE-2026-63336

  RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

  rabbitmq · rabbitmq-java-client

  Medium5.1
• CVE-2026-63337

  RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

  rabbitmq · rabbitmq-java-client

  High7.5
• CVE-2026-69220

  RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

  rabbitmq · rabbitmq-java-client

  High8.7
• CVE-2026-69219

  RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

  rabbitmq · rabbitmq-java-client

  High8.7
• CVE-2026-63335

  RabbitMQ Java client malformed body frame triggers raw command assembler exception

  rabbitmq · rabbitmq-java-client

  Medium6.3