# CVE-2026-106121: RabbitMQ Java client library JSON parser denial of service

Source: https://junglewise.ai/threats/cve-2026-106121-the-rabbitmq-java-client-library-allows-java-and-jvm-based  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-106121 · Severity: medium · CVSS 4.9 · Published 2026-10-06

The RabbitMQ Java client library is used by Java applications to communicate with RabbitMQ message brokers. A flaw in its JSON parser can cause Java applications to run out of memory or consume CPU indefinitely when processing malformed JSON messages, leading to application crashes or hangs that disrupt message processing.

Technologies: [com.rabbitmq:amqp-client (Maven)](https://junglewise.ai/threats/technologies/com-rabbitmq-amqp-client), [RabbitMQ Java client library](https://junglewise.ai/threats/technologies/java-client-library). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-106121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106121 being exploited in the wild.

**How severe is CVE-2026-106121?** Medium severity, with a CVSS score of 4.9, published 6 October 2026.

**Which products and versions are affected?** com.rabbitmq:amqp-client (Maven) <= 5.36.0, ECOSYSTEM:introduced=0,fixed=5.36.1; RabbitMQ Java client library before 5.37.0.

**Is there a fix for CVE-2026-106121?** Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.36.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106121 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106121?** Check whether you run com.rabbitmq:amqp-client (Maven) or RabbitMQ Java client library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.rabbitmq:amqp-client (Maven): upgrade to 5.36.1 or later

  ```sh
  # set com.rabbitmq:amqp-client to 5.36.1 in your pom.xml or build.gradle
  ```


## Technical details

The JSONReader.read() method in com.rabbitmq.tools.json fails to properly handle incomplete input: a truncated string causes the parser to append replacement characters until heap exhaustion, while a line comment without a terminating newline causes indefinite CPU consumption. The vulnerable code path is triggered when JSON-RPC message bodies are parsed by DefaultJsonRpcMapper in JsonRpcServer and client replies, with no authentication required since the parser processes untrusted JSON input.

## Affected products

- RabbitMQ Java client library before 5.37.0

## Identifiers

- CVE-2026-106121
- GHSA-cqgh-8p3p-mx4m

## Timeline

- 2026-10-06: disclosed
- 2026-09-21: patched

## References

- [https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41](https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41)
- [https://github.com/rabbitmq/rabbitmq-java-client/pull/2100](https://github.com/rabbitmq/rabbitmq-java-client/pull/2100)

## Related threats

- [RabbitMQ Java client library credential disclosure in error messages](https://junglewise.ai/threats/cve-2026-106123-the-rabbitmq-java-client-library-allows-java-and-jvm-based)
- [RabbitMQ Java client library UTF-8 parsing denial of service](https://junglewise.ai/threats/cve-2026-106122-the-rabbitmq-java-client-library-allows-java-and-jvm-based)
- [RabbitMQ Java client frame-level OOM via Math.min with unlimited semantics](https://junglewise.ai/threats/cve-2026-75516-rabbitmq-java-client-frame-level-oom-via-math-min-with-unlimited)
- [RabbitMQ Java client protocol violation on oversized frames](https://junglewise.ai/threats/cve-2026-61634-rabbitmq-java-client-protocol-violation-on-oversized-frames)
- [RabbitMQ Java client insecure default TLS certificate validation](https://junglewise.ai/threats/cve-2026-63336-rabbitmq-java-client-insecure-default-tls-certificate-validation)