CVE-2026-63337
Received Received - Intake

Remote Code Execution in RabbitMQ Java Client

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker able to answer the JsonRpcClient request through a shared broker or network interception can select a class already present in the victim JVM and trigger its static initializer, while JsonRpcClient.java later passes getReturnType output to mapper.parse and may also create type confusion. Successful exploitation can affect confidentiality, integrity, and availability in the client process. This issue is fixed in version 5.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-63337
EUVD
EUVD-2026-61043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
com.rabbitmq java_client to 5.33.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the RabbitMQ Java client library versions before 5.33.0. It involves unsafe use of Class.forName in RPC support classes where untrusted input from AMQP messages is used to load classes. An attacker can exploit this by intercepting system.describe requests and injecting malicious class names, triggering static initializers in the JVM or causing type confusion when the class is passed to a JSON mapper.

Detection Guidance

Detecting this vulnerability requires checking the RabbitMQ Java client library version in use. Commands include: mvn dependency:tree for Maven projects, gradle dependencies for Gradle projects, or inspecting the JAR files in the classpath. If the version is below 5.33.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary code in your JVM via static initializers, potentially compromising confidentiality, integrity, and availability of your client process. This could lead to data breaches, unauthorized access, or system crashes if the injected class performs malicious actions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade the RabbitMQ Java client library to version 5.33.0 or later. This can be done via package managers like Maven or Gradle. If upgrading is not immediately possible, restrict network access to RabbitMQ brokers and monitor for suspicious RPC requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart