Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.rabbitmq:amqp-client

12 known vulnerabilities (4 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release
5.37.1 (Nov 6, 2026): no advisory affects it
Newest unaffected release
5.37.1 (Nov 6, 2026), the latest release
Advisories
12 · 4 high, 6 medium
Dependents
105
Releases
157 since 1.3.0 (Jun 23, 2008)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • CVE-2026-106123Medium 5.7

    RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

    Affected: fixed in 5.35.0.

    Fixed in 5.35.0 (released Aug 21, 2026, 46 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • CVE-2026-106122Medium 6.0

    RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

    Affected: fixed in 5.36.0.

    Fixed in 5.36.0 (released Sep 15, 2026, 21 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • CVE-2026-106121Medium 4.9

    RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

    Affected: fixed in 5.36.1.

    Fixed in 5.37.0 (released Oct 1, 2026, 5 days before disclosure, the advisory names 5.36.1, which was never published).

    The latest release, 5.37.1, is not affected.

  • RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

    Affected: fixed in 5.34.0.

    Fixed in 5.34.0 (released Jul 10, 2026, 68 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

    Affected: fixed in 5.33.0.

    Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • CVE-2026-63336Medium 5.1

    RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

    Affected: fixed in 5.33.0.

    Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

    Affected: fixed in 5.33.0.

    Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

    Affected: fixed in 5.33.1.

    Fixed in 5.33.1 (released Jul 6, 2026, 43 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

    Affected: fixed in 5.33.1.

    Fixed in 5.33.1 (released Jul 6, 2026, 43 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • CVE-2026-63335Medium 6.3

    RabbitMQ Java client malformed body frame triggers raw command assembler exception

    Affected: fixed in 5.31.0.

    Fixed in 5.31.0 (released May 28, 2026, 82 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • CVE-2023-46120Medium 4.9

    RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

    Affected: fixed in 5.18.0.

    Fixed in 5.18.0 (released Jun 19, 2023, 127 days before disclosure).

    The latest release, 5.37.1, is not affected.

  • TLS validation error

    Affected: fixed in 4.8.0; from 5.0.0, fixed in 5.4.0.

    Fixed in 4.8.0 (released Aug 31, 2018, 14 days before disclosure) and 5.4.0 (released Aug 31, 2018, 14 days before disclosure).

    The latest release, 5.37.1, is not affected.