Source: rabbitmq-java-client Version: 5.0.0-2 X-Debbugs-CC: [email protected] Severity: importan Tags: security upstream
Hi, The following vulnerabilities were published for rabbitmq-java-client. CVE-2026-106121[0]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to | terminate when input ends inside a quoted string or a line comment | because its string and whitespace scanners do not stop at | CharacterIterator.DONE. The default DefaultJsonRpcMapper passes | JSON-RPC message bodies to this parser for JsonRpcServer and client | replies. A truncated string causes the parser to append replacement | end markers until heap exhaustion, while a line comment without a | terminating newline can keep a thread consuming CPU indefinitely, | resulting in denial of service. This issue is fixed in version | 5.37.0. CVE-2026-106122[1]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes | into replacement characters that can re-encode beyond the AMQP | shortstr limit enforced by ValueWriter.writeShortstr. An attacker | who can submit an RPC message with a malformed echoed property can | cause reply publication in RpcServer.mainloop() or tutorial-style | consumers to throw an unchecked exception before acknowledgement. | The broker requeues the message, allowing the same message to | disable replacement consumers until the queue is purged. This issue | is fixed in version 5.36.0. CVE-2026-106123[2]: | The RabbitMQ Java client library allows Java and JVM-based | applications to connect to and interact with RabbitMQ nodes. Prior | to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri | value in wrapped exceptions when AMQP URI parsing fails. Because the | URI may contain a plaintext username and password, startup logs, | application performance monitoring systems, CI logs, and copied | stack traces can disclose broker credentials to users who should not | have access to them. This issue is fixed in version 5.35.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-106121 https://www.cve.org/CVERecord?id=CVE-2026-106121 [1] https://security-tracker.debian.org/tracker/CVE-2026-106122 https://www.cve.org/CVERecord?id=CVE-2026-106122 [2] https://security-tracker.debian.org/tracker/CVE-2026-106123 https://www.cve.org/CVERecord?id=CVE-2026-106123 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
