CVE-2026-63336
Received Received - Intake

SSL Certificate Validation Bypass in RabbitMQ Java Client

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-63336
EUVD
EUVD-2026-61045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rabbitmq java_client to 5.33.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The RabbitMQ Java client library before version 5.33.0 has a vulnerability where ConnectionFactory.useSslProtocol() and useSslProtocol(String) methods configure a TrustEverythingTrustManager and disable hostname verification. This allows arbitrary server certificates, including self-signed ones, to be accepted. A network attacker can intercept TLS connections, impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without proper validation.

Detection Guidance

Check RabbitMQ Java client library version with: mvn dependency:tree | grep rabbitmq-java-client. If version is below 5.33.0, the system is vulnerable. Inspect application logs for use of useSslProtocol() without hostname verification. Monitor network traffic for unencrypted AMQP connections on port 5672 or plaintext credential transmission.

Impact Analysis

This vulnerability allows attackers to perform man-in-the-middle attacks. They can read sensitive data transmitted over the connection, modify messages without detection, and potentially steal credentials if plaintext authentication is used. The impact includes data breaches, unauthorized access, and service disruption.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, and HIPAA mandates secure transmission of protected health information. The lack of proper TLS validation and potential data exposure violates these regulations.

Mitigation Strategies

Upgrade RabbitMQ Java client to version 5.33.0 or later. Replace useSslProtocol() with useTlsWithNoVerification() only for development. Enable hostname verification and use the default trust store. Disable PLAIN SASL authentication without TLS. Avoid using getPassword() method to prevent plaintext exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart