CVE-2026-106121
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbi…
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.
- Vendor
- vmware
- Product
- rabbitmq java client
- CVSS 3.1
- 7.5 (high), scored by NVD (primary)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1
- 4.9 (medium), scored by security-advisories@github.comCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- CWE
- CWE-835
- Published
- 2026-10-06
- NVD modified
- 2026-10-09
- NVD status
- Analyzed
Not in the CISA KEV catalogue at the last update.
EPSS
0.50% chance of exploitation in the next 30 days (percentile 41st)
FIRST EPSS, updated 17 Oct 2026. About EPSS
CVSS is severity, EPSS is likelihood, KEV means already exploited. EPSS is a statistical probability, not a certainty: a low score does not make a bug safe, and a high one does not prove it is being exploited.
References
- github.com (Patch)
- github.com (Patch)
- github.com (Release Notes)
Data last updated 18 Oct 2026. Sources: NVD API 2.0, FIRST EPSS. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.