rabbitmq rabbitmq-java-client
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106123 | < 5.35.0 | RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-106122 | < 5.36.0 | RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-106121 | < 5.36.1 | RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2026-75516 | < 5.34.0 | RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement | HIGH 8.7 | 0.6 % | ||
| CVE-2026-61634 | < 5.33.0 | RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max | NONE 0.0 | 0.5 % | ||
| CVE-2026-63336 | < 5.33.0 | RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-63337 | < 5.33.0 | RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading | HIGH 7.5 | 0.6 % | ||
| CVE-2026-69220 | < 5.33.1 | RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS | HIGH 8.7 | 0.7 % | ||
| CVE-2026-69219 | < 5.33.1 | RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation | HIGH 8.7 | 0.7 % | ||
| CVE-2026-63335 | < 5.31.0 | RabbitMQ Java client malformed body frame triggers raw command assembler exception | MEDIUM 6.3 | 0.5 % | ||
| CVE-2023-46120 | < 5.18.0 | RabbitMQ Java client's lack of message size limitation leads to remote DoS attack | HIGH 7.5 | 1.3 % |