spring-amqp-deserialization

spring-amqp-deserialization A Proof of Concept of Spring AMQP Deserialization Vulnerability CVE-2023-34050 Affected versions: 1.0.0 to 2.4.16 3.0.0 to 3.0.9 Reference: https://spring.io/security/cve-2023-34050...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

ROOT-APP-MAVEN-CVE-2026-63337 CVE-2026-63337 in com.rabbitmq:amqp-client - Patched by Root

Root has patched CVE-2026-63337 in the com.rabbitmq:amqp-client package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-69219 CVE-2026-69219 in com.rabbitmq:amqp-client - Patched by Root

Root has patched CVE-2026-69219 in the com.rabbitmq:amqp-client package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-69220 CVE-2026-69220 in com.rabbitmq:amqp-client - Patched by Root

Root has patched CVE-2026-69220 in the com.rabbitmq:amqp-client package for Root:Maven. Multiple fixed versions available...

CVE-2016-2173

CVE-2016-2173 - Remote Code Execution in Spring AMQP - App Test Description The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget,...

CVE-2026-77411

RabbitMQ amqp091-go versions before 1.13.0 mishandle an oversized AMQP longstr field. A malicious or compromised broker can desynchronize message parsing, causing subsequent bytes to be interpreted as AMQP data and disrupting connection integrity or availability. Fixed in version 1.13.0. Mitigati...

GHSA-W6R9-248C-FRG8 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...

CVE-2026-107386 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

CVE-2026-107386

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

EUVD-2026-93777

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load...

Wireshark 1.10.x < 1.10.11 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.10.11 advisory. - The dissectwritestructuredfield function in epan/dissectors/packet-tn5250.c in the TN5250 dissector...

DEBIAN-CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

DEBIAN-CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

Encoding Error

Overview Affected versions of this package are vulnerable to Encoding Error in ValueWriter.writeShortstr in com.rabbitmq.client.impl, reached because ValueReader.readShortstr substitutes U+FFFD for malformed UTF-8 bytes on decode, so each bad byte re-encodes to three and a 255 byte shortstr...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation...

FreeBSD : rabbitmq-c -- remote client-side memory exhaustion (03302734-c15d-11f1-8561-107c611e671e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 03302734-c15d-11f1-8561-107c611e671e advisory. The rabbitmq-c project reports: A malicious AMQP peer can trigger memory exhaustion in rabbitmq-c clien...

FreeBSD : rabbitmq-c -- multiple vulnerabilities (03308f12-c15d-11f1-ab87-107c611e671e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 03308f12-c15d-11f1-ab87-107c611e671e advisory. The rabbitmq-c project reports: CVE-2026-44236: A malicious AMQP server can send an undersized...

PT-2026-106843

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.36.0 Description The ValueReader.readShortstr function decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...