RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...

EUVD-2026-93777

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load...

GHSA-H6W7-QMCM-Q6XR RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...

Linux Distros Unpatched Vulnerability : CVE-2026-106121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0,...

Linux Distros Unpatched Vulnerability : CVE-2026-106122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortst...

Linux Distros Unpatched Vulnerability : CVE-2026-106123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0,...

DEBIAN-CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

DEBIAN-CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

DEBIAN-CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

UBUNTU-CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

UBUNTU-CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

UBUNTU-CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

CVE-2026-106123 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...