CVE-2026-106122: RabbitMQ Java client library UTF-8 parsing denial of service

CVE-2026-106122 · Severity: medium · CVSS 4 · Published 2026-10-06

The RabbitMQ Java client library enables JVM-based applications to connect to and interact with RabbitMQ message brokers. An attacker who can send a specially crafted RPC message with malformed UTF-8 bytes can cause consumer applications to crash before acknowledging the message. The message is then requeued and can be used repeatedly to disable replacement consumers, effectively blocking the application from processing messages until the queue is manually purged.

Technologies: com.rabbitmq:amqp-client (Maven), RabbitMQ Java client library. Vendors: Maven, RabbitMQ.

Quick answers

Is CVE-2026-106122 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106122 being exploited in the wild.
How severe is CVE-2026-106122?
Medium severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?
com.rabbitmq:amqp-client (Maven) <= 5.35.0, ECOSYSTEM:introduced=0,fixed=5.36.0; RabbitMQ Java client library prior to 5.36.0.
Is there a fix for CVE-2026-106122?
Yes. com.rabbitmq:amqp-client (Maven): upgrade to 5.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106122 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106122?
Check whether you run com.rabbitmq:amqp-client (Maven) or RabbitMQ Java client library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.rabbitmq:amqp-client (Maven): upgrade to 5.36.0 or later
    # set com.rabbitmq:amqp-client to 5.36.0 in your pom.xml or build.gradle

Technical details

The vulnerability exists in ValueReader.readShortstr, which decodes malformed UTF-8 bytes into replacement characters that can expand beyond the AMQP shortstr size limit. When ValueWriter.writeShortstr enforces this limit on re-encoding, it throws an unchecked exception. An attacker sending an RPC message with a malformed echoed property triggers this exception in RpcServer.mainloop() before message acknowledgement, causing requeue and repeated denial of service.

Affected products

  • RabbitMQ Java client library prior to 5.36.0

Identifiers

  • CVE-2026-106122
  • GHSA-7822-rcf6-97fx

Timeline

  • 2026-10-06: disclosed
  • 2026-08-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.