rabbitmq-java-client vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Latest rabbitmq-java-client vulnerabilities

CVE-2026-106123 — RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() (CVSS 5.5)
CVE-2026-106122 — RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers (CVSS 7.5)
CVE-2026-106121 — RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS (CVSS 7.5)
CVE-2026-75516 — RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement (CVSS 8.7)
CVE-2026-69220 — RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS (CVSS 8.7)
CVE-2026-69219 — RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation (CVSS 8.7)
CVE-2026-63337 — RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading (CVSS 7.5)
CVE-2026-63336 — RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM (CVSS 5.1)
CVE-2026-63335 — RabbitMQ Java client malformed body frame triggers raw command assembler exception (CVSS 6.3)
CVE-2026-61634 — RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max (CVSS 0.0)
CVE-2023-46120 — RabbitMQ Java client's lack of message size limitation leads to remote DoS attack (CVSS 7.5)
CVE-2018-11087 — TLS validation error (CVSS 5.9)