Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially...

Allocation of Resources Without Limits or Throttling

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader...

EUVD-2026-93775

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers...

GHSA-7822-RCF6-97FX RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...

com.cisco.oss.foundation.queue:queue-rabbitmq (>=1.0.3-1, <=1.0.4-2), com.daedafusion:events-rabbitmq (1.0) +5 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.4.4)

com.rabbitmq:amqp-client MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.cisco.oss.foundation.queue:queue-rabbitmq =1.0.3-1, =3.0.0, =2.1.0-rc1, =2.1.0-rc1, =2.1.0-rc1, =2.3.3 Sour...

org.apache.beam:beam-sdks-java-io-rabbitmq (>=2.13.0, <=2.17.0) potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (4.9.3)

com.rabbitmq:amqp-client MAVEN version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.beam:beam-sdks-java-io-rabbitmq =2.13.0, =2.17.0 Source cves: CVE-2026-106122 Source advisory:...

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

Summary A single AMQP message with malformed UTF-8 in a shortstr property for example correlation-id can permanently disable a Java client RPC consumer. The client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765...

Security Bulletin:Jackson-databind Vulnerability: Record Constructor Bypass via PropertyNamingStrategy

Summary jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals record...

Security Bulletin:Bouncy Castle Java OER Parser Recursion Issue on IEEE 1609.2 Schema

Summary In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcutil-fips 2.0.7 2.0.X series and 2.1.7 2.1.X series...

SUSE CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

SUSE CVE-2026-106122

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by...

SUSE CVE-2026-106123

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext usernam...

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...

EUVD-2026-93777

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load...

GHSA-H6W7-QMCM-Q6XR RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Summary When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. Details...

com.cisco.oss.foundation.queue:queue-rabbitmq (>=1.0.3-1, <=1.0.4-2), com.daedafusion:events-rabbitmq (1.0) +5 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (3.4.4)

com.rabbitmq:amqp-client MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.cisco.oss.foundation.queue:queue-rabbitmq =1.0.3-1, =3.0.0, =2.1.0-rc1, =2.1.0-rc1, =2.1.0-rc1, =2.3.3 Sour...

com.activitystream:as-sdk (>=0.1.13, <=0.1.25), com.alibaba.blink:flink-connector-rabbitmq_2.11 (>=blink-3.2.0, <=1.5.1) +25 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.2.0)

com.rabbitmq:amqp-client MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.activitystream:as-sdk =0.1.13, =blink-3.2.0, =1.2, =1.2, =0.0.2.10, =1.4.0, =1.4.0, =1.0-beta5, =1.1.1 -...

org.apache.beam:beam-sdks-java-io-rabbitmq (>=2.13.0, <=2.17.0) potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.9.3)

com.rabbitmq:amqp-client MAVEN version 4.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.apache.beam:beam-sdks-java-io-rabbitmq =2.13.0, =2.17.0 Source cves: CVE-2026-106123 Source advisory:...

com.meltwater:rxrabbit (1.3.0), com.rabbitmq.jms:rabbitmq-jms (>=1.8.0, <=1.8.1) +6 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (4.3.0)

com.rabbitmq:amqp-client MAVEN version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.meltwater:rxrabbit 1.3.0 - com.rabbitmq.jms:rabbitmq-jms =1.8.0, =2.2.2, =2.2.2, =2.2.0, =2.2.0, =1.0.14,...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-106452 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-106452 Source advisory: SNYK:JAVA-ORGLZ4-20570532...