Patch Forecast
Amber warning
Patch this week.

CVE-2026-106122 · GHSA-7822-rcf6-97fx

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Risk score
68/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.5%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacke…
Affected
com.rabbitmq:amqp-client (maven) <= 5.35.0
Fix
Upgrade com.rabbitmq:amqp-client to 5.36.0 or later.
Exploitation
Public proof of concept

Story map

Story map: com.rabbitmq:amqp-clientTHE FLAWSTHE FIXCVE-2026-106122RabbitMQ: Malformed UTF-8 inshortstr propertiespermanently disables RPC…CVSS 7.5 · EPSS 0%CVE-2026-106121RabbitMQ: JSONReader in thedefault JSON-RPC mappernever terminates on…CVSS 7.5 · EPSS 1%CVE-2026-106123RabbitMQ Java client: plaintextbroker credentials leaked inexception message from…CVSS 5.5 · EPSS 0%Upgrade…5.36.0 · 5.37.0 · 5.35.0or later on your release lineWho is exposedcom.rabbitmq:amqp-client(maven) <= 5.36.0AMBER · PATCH THIS WEEKcom.rabbitmq:amqp-clientThe RabbitMQ Java client libraryallows Java and JVM-basedapplications to connect to andinteract with RabbitMQ nodes.Prior to 5.37.0,com.rabbitmq.tools.json.JSONReader.read() fails to terminate…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-172 (CWE-172)4 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

com.rabbitmq:amqp-client: Amber, patch this week. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at Charac…

The flaws

  • CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers (CVSS 7.5 · EPSS 0%)
  • CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS (CVSS 7.5 · EPSS 1%)
  • CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() (CVSS 5.5 · EPSS 0%)

The fix

Upgrade com.rabbitmq:amqp-client: 5.36.0 · 5.37.0 · 5.35.0 or later on your release line

Who is exposed: com.rabbitmq:amqp-client (maven) <= 5.36.0

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in
  • On your watchlist: Maven

Affected packages

PackageEcosystemVulnerableFixed in
com.rabbitmq:amqp-clientmaven<= 5.35.05.36.0

References

Original description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.

Last activity 6 Oct 2026. Patch Forecast updates every hour.