CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 41.1%

CVSS Severity

CVSS v3 Score 4.9

References

Products affected by CVE-2026-106121

Vmware » Rabbitmq Java Client » Version: 5.21.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.21.0
Vmware » Rabbitmq Java Client » Version: 5.22.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.22.0
Vmware » Rabbitmq Java Client » Version: 5.23.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.23.0
Vmware » Rabbitmq Java Client » Version: 5.24.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.24.0
Vmware » Rabbitmq Java Client » Version: 5.25.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.25.0
Vmware » Rabbitmq Java Client » Version: 5.26.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.26.0
Vmware » Rabbitmq Java Client » Version: 5.27.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.27.0
Vmware » Rabbitmq Java Client » Version: 5.27.1

cpe:2.3:a:vmware:rabbitmq_java_client:5.27.1
Vmware » Rabbitmq Java Client » Version: 5.28.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.28.0
Vmware » Rabbitmq Java Client » Version: 5.29.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.29.0
Vmware » Rabbitmq Java Client » Version: 5.30.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.30.0
Vmware » Rabbitmq Java Client » Version: 5.31.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.31.0
Vmware » Rabbitmq Java Client » Version: 5.32.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.32.0
Vmware » Rabbitmq Java Client » Version: 5.33.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.33.0
Vmware » Rabbitmq Java Client » Version: 5.33.1

cpe:2.3:a:vmware:rabbitmq_java_client:5.33.1
Vmware » Rabbitmq Java Client » Version: 5.34.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.34.0
Vmware » Rabbitmq Java Client » Version: 5.35.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.35.0
Vmware » Rabbitmq Java Client » Version: 5.36.0

cpe:2.3:a:vmware:rabbitmq_java_client:5.36.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-106121

Products

Pricing

Contact Us