PT-2026-82544

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description Applications that send logs to RabbitMQ over TLS using the Log4j2 appender are...

CVE-2026-59272: Improper Validation of Certificate with Host Mismatch

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

SUSE CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

SUSE CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

SUSE CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

SUSE CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

SUSE CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

CVE-2026-57216

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication mechanisms incorrectly perform a loopback check. This allows a user, typically restricted to loopback connections such as a guest user, to connect remotely. This occurs whe...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.5-0.1.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.5-0.1.hum1.src src Security Fixes: rabbitmq-server4.3: CVE-2026-59248 CVE-2026-65624...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...

Denial-of-Service (DoS)

RabbitMQ Java client is vulnerable to a Denial-of-Service DoS. The vulnerability is due to CommandAssembler.consumeBodyFrame subtracting an attacker-controlled payload length before validating it, which allows a malicious or compromised RabbitMQ broker to send a malformed AMQP frame sequence...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. An attacker can obtain sensitive credentials by accessing exception messages that are logged,...

Uncontrolled Resource Consumption

RabbitMQ Java client library is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to ValueReader.readBytes allocating a byte array based on a wire-declared content length before verifying the actual bytes available in the frame, which allows a malicious unauthenticated AMQ...

Linux Distros Unpatched Vulnerability : CVE-2026-63336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

Linux Distros Unpatched Vulnerability : CVE-2026-63337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

Linux Distros Unpatched Vulnerability : CVE-2026-69219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-63335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command...

Linux Distros Unpatched Vulnerability : CVE-2026-69220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-61634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection...