Bug#1150244: rabbitmq-java-client: CVE-2026-106121 CVE-2026-106122 CVE-2026-106123

[Salvatore Bonaccorso]

Source: rabbitmq-java-client
Version: 5.0.0-2
X-Debbugs-CC: team at security.debian.org
Severity: importan
Tags: security upstream

Hi,

The following vulnerabilities were published for rabbitmq-java-client.

CVE-2026-106121[0]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to
| terminate when input ends inside a quoted string or a line comment
| because its string and whitespace scanners do not stop at
| CharacterIterator.DONE. The default DefaultJsonRpcMapper passes
| JSON-RPC message bodies to this parser for JsonRpcServer and client
| replies. A truncated string causes the parser to append replacement
| end markers until heap exhaustion, while a line comment without a
| terminating newline can keep a thread consuming CPU indefinitely,
| resulting in denial of service. This issue is fixed in version
| 5.37.0.


CVE-2026-106122[1]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes
| into replacement characters that can re-encode beyond the AMQP
| shortstr limit enforced by ValueWriter.writeShortstr. An attacker
| who can submit an RPC message with a malformed echoed property can
| cause reply publication in RpcServer.mainloop() or tutorial-style
| consumers to throw an unchecked exception before acknowledgement.
| The broker requeues the message, allowing the same message to
| disable replacement consumers until the queue is purged. This issue
| is fixed in version 5.36.0.


CVE-2026-106123[2]:
| The RabbitMQ Java client library allows Java and JVM-based
| applications to connect to and interact with RabbitMQ nodes. Prior
| to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri
| value in wrapped exceptions when AMQP URI parsing fails. Because the
| URI may contain a plaintext username and password, startup logs,
| application performance monitoring systems, CI logs, and copied
| stack traces can disclose broker credentials to users who should not
| have access to them. This issue is fixed in version 5.35.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-106121
    https://www.cve.org/CVERecord?id=CVE-2026-106121
[1] https://security-tracker.debian.org/tracker/CVE-2026-106122
    https://www.cve.org/CVERecord?id=CVE-2026-106122
[2] https://security-tracker.debian.org/tracker/CVE-2026-106123
    https://www.cve.org/CVERecord?id=CVE-2026-106123

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore