CVE-2026-75516 RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

CVE-2026-75516

The RabbitMQ Java client (versions prior to 5.34.0 ) contains a logic flaw where AMQConnection.start() computes Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune negotiation. Since both the client default and AMQP's zero-value frameMax resolve to zero, Utils.framePayloadLimit(in...

CVE-2026-75516: Allocation of Resources Without Limits or Throttling

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

Improper Certificate Validation

org.mariadb.jdbc:mariadb-java-client is vulnerable to Improper Certificate Validation. The vulnerability is due to improper certificate fingerprint validation during the initial TLS handshake, which allows an active man-in-the-middle attacker or malicious server to present a self-signed certifica...

GHSA-XVR9-35CR-46V9 org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

EUVD-2026-68021

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the SendPamAuthPacketFactory process. An attacker can obtain sensitive authentication credentials by intercepting network traffic or acting as a man-in-the-middle server during the authentication...

GHSA-QXVW-FVWX-5CP7 org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

EUVD-2026-68020

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is...

SUSE CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

SUSE CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

SUSE CVE-2026-63337

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

SUSE CVE-2026-69219

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAXVALUE and allocate a...

SUSE CVE-2026-69220

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...

Denial-of-Service (DoS)

RabbitMQ Java client is vulnerable to a Denial-of-Service DoS. The vulnerability is due to CommandAssembler.consumeBodyFrame subtracting an attacker-controlled payload length before validating it, which allows a malicious or compromised RabbitMQ broker to send a malformed AMQP frame sequence...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...