GHSA-5M9F-RPHJ-C435 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

com.espertech:esperio-amqp (>=4.6.0, <=7.1.0), io.brooklyn.example:brooklyn-example-global-web-fabric (0.4.0) +9 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (2.7.1)

com.rabbitmq:amqp-client MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.espertech:esperio-amqp =4.6.0, =7.1.0 - io.brooklyn.example:brooklyn-example-global-web-fabric 0.4.0 -...

com.github.sstone:akka-amqp-proxies_2.10 (>=1.1-rc1, <=1.3), com.github.sstone:akka-amqp-proxies_2.10.1 (1.2) +1 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.0.1)

com.rabbitmq:amqp-client MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 =1.1-rc1, =1.1-rc1, =1.1 Source cves: CVE-2026-63336 Source advisory:...

net.leanix:leanix-dropkit (>=0.7.4, <=1.3.21), net.leanix:leanix-dropkit-persistence (>=1.0.0, <=1.1.6) +6 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.4.0)

com.rabbitmq:amqp-client MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - net.leanix:leanix-dropkit =0.7.4, =1.0.0, =1.6.4, =1.7.14 - net.liftmodules:amqp3.02.11 1.4.0 -...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.11.13, <=2.12.9), io.zipkin.reporter2:zipkin-reporter-spring-beans (>=2.7.15, <=2.8.2) +3 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.10.0)

com.rabbitmq:amqp-client MAVEN version 4.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.11.13, =2.7.15, =2.7.15, =2.11.13, =2.12.9 -...

com.github.sstone:akka-amqp-proxies_2.10 (1.4-ml1), com.github.sstone:amqp-client_2.10 (>=1.3-ml1, <=1.4-ml4) +4 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.2.1)

com.rabbitmq:amqp-client MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 1.4-ml1 - com.github.sstone:amqp-client2.10 =1.3-ml1, =0.9.0, =0.7.0,...

com.accelerate-experience:storm-rabbitmq (1.0.0), com.github.durre:microservices_2.11 (1.2.3) +20 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.6.1)

com.rabbitmq:amqp-client MAVEN version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.accelerate-experience:storm-rabbitmq 1.0.0 - com.github.durre:microservices2.11 1.2.3 -...

com.rabbitmq.jms:rabbitmq-jms (>=1.15.0, <=1.15.2), com.smoketurner.dropwizard:zipkin-core (2.0.16-1) +101 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.12.0)

com.rabbitmq:amqp-client MAVEN version 4.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.rabbitmq.jms:rabbitmq-jms =1.15.0, =2.4.2.0-17, =2.4.2.0-17, =2.4.2.0-17, =4.1.3, =4.1.3, =4.1.3, =4.1.3,...

io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq (>=2.4.6, <=2.6.1), io.zipkin.java:zipkin-collector-rabbitmq (>=2.4.6, <=2.6.1) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.4.2)

com.rabbitmq:amqp-client MAVEN version 4.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - io.zipkin.java:zipkin-autoconfigure-collector-rabbitmq =2.4.6, =2.4.6, =2.6.1 Source cves: CVE-2026-63336 Sourc...

com.github.sstone:amqp-client_2.10 (1.2), mx.bigdata.utils:amqp-utils (1.2.1) +3 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.1.1)

com.rabbitmq:amqp-client MAVEN version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:amqp-client2.10 1.2 - mx.bigdata.utils:amqp-utils 1.2.1 - org.atmosphere:atmosphere-rabbitmq...

com.automationrockstars:gunter-rabbit (>=1.0.2, <=2.0.3), com.rabbitmq.jms:rabbitmq-jms (1.4.7) +4 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.6.2)

com.rabbitmq:amqp-client MAVEN version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.automationrockstars:gunter-rabbit =1.0.2, =1.1.1, =3.3.0.cr1, =3.3.0.cr1, =2.1.0-alpha.1, =2.1.0-alpha.2...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.11.0, <=0.13.1), org.iplantc.core:metadactyl (1.8.4) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (2.1.0)

com.rabbitmq:amqp-client MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.11.0, =0.13.1 - org.iplantc.core:metadactyl 1.8.4 Source cves...

com.smoketurner.dropwizard:zipkin-core (>=1.3.8-1, <=1.3.9-1), io.dropwizard.metrics:metrics-graphite (4.1.0-rc3) +5 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.9.1)

com.rabbitmq:amqp-client MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.smoketurner.dropwizard:zipkin-core =1.3.8-1, =2.0.0-rc0+test8, =2.11.9, =2.7.12, =2.7.12, =2.11.9, =2.12.0...

org.elasticsearch:elasticsearch-river-rabbitmq (>=0.17.0, <=1.0.0) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (2.5.1)

com.rabbitmq:amqp-client MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.elasticsearch:elasticsearch-river-rabbitmq =0.17.0, =1.0.0 Source cves: CVE-2026-63336 Source advisory:...

com.qaprosoft:carina-api (>=6.0.4, <=6.1.24), com.qaprosoft:carina-aws-s3 (>=6.0.4, <=6.1.24) +6 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.9.0)

com.rabbitmq:amqp-client MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.qaprosoft:carina-api =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =6.0.4, =3.3.48, =4.0.58 -...

org.apache.beam:beam-sdks-java-io-rabbitmq (>=2.13.0, <=2.17.0) potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.9.3)

com.rabbitmq:amqp-client MAVEN version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.beam:beam-sdks-java-io-rabbitmq =2.13.0, =2.17.0 Source cves: CVE-2026-63336 Source advisory:...

com.codacy:metrics-dropwizard_2.11 (>=1.0.33, <=3.1.2), com.codacy:metrics-dropwizard_2.12 (>=1.0.33, <=3.1.2) +428 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.4.1)

com.rabbitmq:amqp-client MAVEN version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.codacy:metrics-dropwizard2.11 =1.0.33, =1.0.33, =3.1.0, =1.30.0, =1.29.0, =1.29.0, =1.2.0, =v0.0.5, =v0.0.5...

com.ahome-it:ahome-tooling-server-core (1.1.0-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.0-release) +153 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.5.7)

com.rabbitmq:amqp-client MAVEN version 3.5.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.1.0-release - com.ahome-it:ahome-tooling-server-hazelcast 1.1.0-releas...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), cn.hyperchain.javasdk:hyperchainsdk (>=4.2.1, <=4.2.3) +123 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (4.0.2)

com.rabbitmq:amqp-client MAVEN version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - br.jus.stf.digital:core =2.0.0, =4.2.1, =1.1.0, =0.10, =0.10, =1.2.0, =1.2.0, =0.10, =0.10, =1.0.0-rc1,...

com.coiney:akka-rabbit-core_2.10 (0.3.0), com.coiney:akka-rabbit-core_2.11 (0.3.0) +7 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.3.3)

com.rabbitmq:amqp-client MAVEN version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.coiney:akka-rabbit-core2.10 0.3.0 - com.coiney:akka-rabbit-core2.11 0.3.0 - net.roboconf:roboconf-agent =0....