CVE-2026-106121

Analyzed Analyzed - Analysis Complete

JSON-RPC DoS in RabbitMQ Java Client Library

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106121

EUVD

EUVD-2026-93773

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	rabbitmq_java_client	to 5.37.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

The RabbitMQ Java client library before version 5.37.0 has a flaw in its JSON parsing function com.rabbitmq.tools.json.JSONReader.read(). When processing input that ends abruptly inside a quoted string or a line comment, the parser fails to stop correctly. This causes it to keep reading and appending data until it exhausts system memory or consumes excessive CPU, leading to a denial of service condition.

Detection Guidance

Detection involves checking the RabbitMQ Java client library version in use. Commands like 'find / -name "amqp-client*.jar" 2>/dev/null' or 'mvn dependency:tree' in Java projects can identify the library version. If the version is below 5.37.0, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of the RabbitMQ Java client library, an attacker could send specially crafted JSON-RPC messages to crash your application or server by triggering excessive memory usage or CPU consumption. This could disrupt services relying on RabbitMQ for messaging.

Compliance Impact

This vulnerability primarily causes denial of service by exhausting system resources or consuming CPU indefinitely. It does not directly affect data confidentiality, integrity, or privacy, which are key concerns for GDPR and HIPAA. However, prolonged denial of service could indirectly impact compliance by disrupting services handling sensitive data.

Mitigation Strategies

Upgrade the RabbitMQ Java client library to version 5.37.0 or later. For Java applications, update the dependency in Maven or Gradle. For systems using RabbitMQ, ensure all connected clients use the patched version to prevent denial of service.

Hi! I’m here to help you understand CVE-2026-106121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70