Most recent entries from all

fkie_cve-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

GHSA-cqgh-8p3p-mx4m — RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Affected: Maven: com.rabbitmq:amqp-client

## Summary

`com.rabbitmq.tools.json.JSONReader.read()` never returns when its input ends inside a quoted string or a `//` line comment. Both scanners walk the input with `StringCharacterIterator.next()` but only compare against a delimiter, so once the iterator reaches `CharacterIterator.DONE` (``) they loop forever. The string scanner (`string()`, line 210, `while (c != sep)`) also appends `` to a `StringBuilder` every iteration, so it fills the heap and throws `OutOfMemoryError`, taking down the JVM. The comment scanner (`skipWhiteSpace()`, lines 89-92, `while (c != '\n')`) pins a thread at 100% CPU with no allocation.

This is reachable with a single message. `JsonRpcServer` and `JsonRpcClient` fall back to `DefaultJsonRpcMapper` whenever no mapper is passed (`JsonRpcServer.java:84` and `:114`, `JsonRpcClient.java:186`), and that mapper hands the raw message body straight to `JSONReader.read()` (`DefaultJsonRpcMapper.java:42` for the server request, `:52` for the client reply). A caller that can publish to the RPC request queue hangs the server; a malicious or MITM'd JSON-RPC service does the same to a client.

## Proof of concept

Against `amqp-client` 5.36.0 from Maven Central:

```java import com.rabbitmq.tools.jsonrpc.DefaultJsonRpcMapper;

public class Poc { public static void main(String[] args) { DefaultJsonRpcMapper mapper = new DefaultJsonRpcMapper(); mapper.parse("{\"method\":\"x", String.class); // unterminated string // mapper.pars…

UBUNTU-CVE-2026-106121

Affected: Ubuntu:18.04:LTS: rabbitmq-java-client, Ubuntu:20.04:LTS: rabbitmq-java-client, Ubuntu:22.04:LTS: rabbitmq-java-client, Ubuntu:24.04:LTS: rabbitmq-java-client, Ubuntu:26.04:LTS: rabbitmq-java-client

(The RabbitMQ Java client library allows Java and JVM-based application ...)