# com.rabbitmq:amqp-client (Maven) vulnerabilities 12 known vulnerabilities (4 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.37.1 (Nov 6, 2026): no advisory affects it - Newest unaffected release: 5.37.1 (Nov 6, 2026), the latest release - Dependents: 105 - Releases: 157 since 1.3.0 (Jun 23, 2008) - Registry: https://central.sonatype.com/artifact/com.rabbitmq/amqp-client - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-106123: 1.3.0 to 5.34.0 (5.35.0 is outside it) - CVE-2026-106122: 1.3.0 to 5.35.0 (5.36.0 is outside it) - CVE-2026-106121: 1.3.0 to 5.36.0 (5.37.0 is outside it) - CVE-2026-75516: 1.3.0 to 5.33.1 (5.34.0 is outside it) - CVE-2026-61634: 1.3.0 to 5.32.0 (5.33.0 is outside it) - CVE-2026-63336: 1.3.0 to 5.32.0 (5.33.0 is outside it) - CVE-2026-63337: 1.3.0 to 5.32.0 (5.33.0 is outside it) - CVE-2026-69220: 1.3.0 to 5.33.0 (5.33.1 is outside it) - CVE-2026-69219: 1.3.0 to 5.33.0 (5.33.1 is outside it) - CVE-2026-63335: 1.3.0 to 5.30.0 (5.31.0 is outside it) - CVE-2023-46120: 1.3.0 to 5.17.1 (5.18.0 is outside it) - CVE-2018-11087: 1.3.0 to 4.7.0 (4.8.0 is outside it); 5.0.0 to 5.3.0 (5.4.0 is outside it) ## Advisories (12) ### [CVE-2026-106123](https://cve.now/CVE-2026-106123): RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() - Severity: Medium 5.7 - Published: Oct 6, 2026 - Affected: fixed in 5.35.0. - Fixed in 5.35.0 (released Aug 21, 2026, 46 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-106122](https://cve.now/CVE-2026-106122): RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers - Severity: Medium 6.0 - Published: Oct 6, 2026 - Affected: fixed in 5.36.0. - Fixed in 5.36.0 (released Sep 15, 2026, 21 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-106121](https://cve.now/CVE-2026-106121): RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS - Severity: Medium 4.9 - Published: Oct 6, 2026 - Affected: fixed in 5.36.1. - Fixed in 5.37.0 (released Oct 1, 2026, 5 days before disclosure, the advisory names 5.36.1, which was never published). - The latest release, 5.37.1, is not affected. ### [CVE-2026-75516](https://cve.now/CVE-2026-75516): RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement - Severity: High 8.7 - Published: Sep 16, 2026 - Affected: fixed in 5.34.0. - Fixed in 5.34.0 (released Jul 10, 2026, 68 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-61634](https://cve.now/CVE-2026-61634): RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame\_max - Severity: None 0.0 - Published: Aug 18, 2026 - Affected: fixed in 5.33.0. - Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-63336](https://cve.now/CVE-2026-63336): RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM - Severity: Medium 5.1 - Published: Aug 18, 2026 - Affected: fixed in 5.33.0. - Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-63337](https://cve.now/CVE-2026-63337): RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading - Severity: High 7.5 - Published: Aug 18, 2026 - Affected: fixed in 5.33.0. - Fixed in 5.33.0 (released Jun 30, 2026, 49 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-69220](https://cve.now/CVE-2026-69220): RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: fixed in 5.33.1. - Fixed in 5.33.1 (released Jul 6, 2026, 43 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-69219](https://cve.now/CVE-2026-69219): RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: fixed in 5.33.1. - Fixed in 5.33.1 (released Jul 6, 2026, 43 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2026-63335](https://cve.now/CVE-2026-63335): RabbitMQ Java client malformed body frame triggers raw command assembler exception - Severity: Medium 6.3 - Published: Aug 18, 2026 - Affected: fixed in 5.31.0. - Fixed in 5.31.0 (released May 28, 2026, 82 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2023-46120](https://cve.now/CVE-2023-46120): RabbitMQ Java client's lack of message size limitation leads to remote DoS attack - Severity: Medium 4.9 - Published: Oct 24, 2023 - Affected: fixed in 5.18.0. - Fixed in 5.18.0 (released Jun 19, 2023, 127 days before disclosure). - The latest release, 5.37.1, is not affected. ### [CVE-2018-11087](https://cve.now/CVE-2018-11087): TLS validation error - Severity: Unrated - Published: Sep 14, 2018 - Affected: fixed in 4.8.0; from 5.0.0, fixed in 5.4.0. - Fixed in 4.8.0 (released Aug 31, 2018, 14 days before disclosure) and 5.4.0 (released Aug 31, 2018, 14 days before disclosure). - The latest release, 5.37.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/com.rabbitmq:amqp-client Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.