CVE-2026-63337

A flaw was found in the RabbitMQ Java client library. A remote attacker, by intercepting or answering a JsonRpcClient request, could provide a malicious javaReturnType value. This unvalidated input is then used in Class.forName, allowing the attacker to load an arbitrary class already present in...

CVE-2026-70410

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...

EUVD-2026-84533

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...

CVE-2026-70410

Apache Calcite Avatica versions before 1.29.0 are vulnerable to an Unsafe Reflection vulnerability. The root cause is the use of externally-controlled input in methods such as AvaticaUtils#instantiatePlugin, which performs unrestricted calls to Class.forName(String). This allows for the initializ...

CVE-2026-70410: Use of Externally-Controlled Input to Select Classes or Code

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...

CVE-2026-45794

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-45794

OpenAM Community Edition (through 16.0.6 ) is vulnerable to unsafe Java deserialization (CWE-502) in its Push Notification SNS callback resource (SnsMessageResource ). The route is mounted with anonymous access ; after a message ID expires from the in-memory dispatcher, it falls back to a CTS-sto...

CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-45794 OpenAM Unsafe Java Deserialization via SNS

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

CVE-2026-62379 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implement...

CVE-2026-62379 OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Open Access Management OpenAM is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts a CustomCallback XML element whose className value selects an arbitrary Java class for AuthXMLUtils to load and instantiate without verifying that it implement...

CVE-2026-45794: Deserialization of Untrusted Data

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names fo...

SUSE CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...

Linux Distros Unpatched Vulnerability : CVE-2026-63337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via ProcedureDescription.computeReturnTypeAsJavaClass in src/main/java/com/rabbitmq/tools/jsonrpc/ProcedureDescription.java. An attacker can trigger loadin...

CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

GHSA-6G32-PXV4-2WFJ RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forNamejavaReturnType with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist. Vulnerable code ProcedureDescription.java:101-127: When a JsonRpcClient connects, it calls...

CVE-2026-63337

The RabbitMQ Java client (pre-5.33.0) passes an untrusted javaReturnType from system.describe through Class.forName with initialization enabled, allowing an attacker controlling broker responses to trigger arbitrary class static initializers in the victim JVM, affecting confidentiality, integrity...

CVE-2026-63337 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...