CVE-2026-106121

Overview

The RabbitMQ Java Client is the RabbitMQ team's AMQP 0.9.1 client library, which allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. It is published to Maven Central as com.rabbitmq:amqp-client, and Spring AMQP applications, including Spring Boot ones, use it through spring-rabbit's CachingConnectionFactory.

A denial of service vulnerability (CVE-2026-106121) has been identified in the JSON reader used by the RabbitMQ Java Client's JSON-RPC support, which allows attackers to exhaust the heap or keep a thread busy at full CPU with a single truncated JSON-RPC message.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects all versions of the RabbitMQ Java Client up to and including 5.36.0.

Details

Module Info

• Product: RabbitMQ Java Client
• Affected packages: com.rabbitmq:amqp-client
• Affected versions: <=5.36.0
• GitHub repository: https://github.com/rabbitmq/rabbitmq-java-client
• Published packages: https://central.sonatype.com/artifact/com.rabbitmq/amqp-client
• Package manager: Maven
• Fixed in:
  • OSS RabbitMQ Java Client 5.37.0
  • NES for RabbitMQ Java Client v5.24.2

Vulnerability Info

This Medium-severity vulnerability is found in the com.rabbitmq:amqp-client package in all versions of the RabbitMQ Java Client up to and including 5.36.0.

The JSON-RPC tooling in com.rabbitmq.tools.jsonrpc uses DefaultJsonRpcMapper whenever no mapper is supplied. JsonRpcServer uses it to parse incoming request bodies, and JsonRpcClient uses it to parse replies. The mapper hands the raw message body to com.rabbitmq.tools.json.JSONReader:

public JsonRpcRequest parse(String requestBody, ServiceDescription description) {
    @SuppressWarnings("unchecked")
    Map<String, Object> request = (Map<String, Object>) new JSONReader().read(requestBody);
    ...
}

JSONReader walks the input with a StringCharacterIterator. When the iterator runs past the end of the input it returns CharacterIterator.DONE (\uffff) on every further call, but the string and comment scanners only compare the current character against their closing delimiter:

private void skipWhiteSpace() {
    ...
    else if (c == '/' && next() == '/') {
        while (c != '\n') {
            next();
        }
    }
    ...
}

private Object string(char sep) {
    buf.setLength(0);
    while (c != sep) {
        ...
        } else {
            add();
        }
    }
    next();
    return buf.toString();
}

If a message body ends inside a quoted string, such as {"method":"x, string() never sees the closing quote and appends \uffff to its StringBuilder on every iteration until the JVM throws OutOfMemoryError. If a body ends inside a // line comment with no newline, skipWhiteSpace() spins forever and pins the consuming thread at 100% CPU. JsonRpcServer.doCall() catches only ClassCastException around request handling, so neither failure is contained to the one request. Anyone who can publish to the JSON-RPC request queue can stop the server, and a malicious JSON-RPC service can do the same to a client. Only applications that use the JSON-RPC tooling with the default, deprecated DefaultJsonRpcMapper are affected.

Steps to Reproduce

1. Add com.rabbitmq:amqp-client 5.36.0 or earlier to the classpath.

2. Compile and run the following class with a small heap, for example java -Xmx64m Poc:

import com.rabbitmq.tools.jsonrpc.DefaultJsonRpcMapper;

public class Poc {
    public static void main(String[] args) {
        DefaultJsonRpcMapper mapper = new DefaultJsonRpcMapper();
        mapper.parse("{\"method\":\"x", String.class); // unterminated string
        // mapper.parse("//", String.class);           // unterminated // comment
        System.out.println("unreachable");
    }
}

3. The unterminated string throws OutOfMemoryError: Java heap space almost immediately and never prints. Swapping in the // line instead leaves the thread spinning at 100% CPU without returning.

Mitigation

The RabbitMQ team lists the AMQP 0.9.1 Java Client 5.x series as currently supported and ships fixes in new 5.x releases. Upstream has made no 5.24.x release since 5.24.0 (December 2024), so no 5.24.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a release of the RabbitMQ Java Client 5.x series that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Iain (finder)