{"schema":"threatline.record/2","record":{"id":"CVE-2026-106121","aliases":["GHSA-cqgh-8p3p-mx4m"],"summary":"RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS","details":"## Summary\n\n`com.rabbitmq.tools.json.JSONReader.read()` never returns when its input ends inside a quoted string or a `//` line comment. Both scanners walk the input with `StringCharacterIterator.next()` but only compare against a delimiter, so once the iterator reaches `CharacterIterator.DONE` (`￿`) they loop forever. The string scanner (`string()`, line 210, `while (c != sep)`) also appends `￿` to a `StringBuilder` every iteration, so it fills the heap and throws `OutOfMemoryError`, taking down the JVM. The comment scanner (`skipWhiteSpace()`, lines 89-92, `while (c != '\\n')`) pins a thread at 100% CPU with no allocation.\n\nThis is reachable with a single message. `JsonRpcServer` and `JsonRpcClient` fall back to `DefaultJsonRpcMapper` whenever no mapper is passed (`JsonRpcServer.java:84` and `:114`, `JsonRpcClient.java:186`), and that mapper hands the raw message body straight to `JSONReader.read()` (`DefaultJsonRpcMapper.java:42` for the server request, `:52` for the client reply). A caller that can publish to the RPC request queue hangs the server; a malicious or MITM'd JSON-RPC service does the same to a client.\n\n## Proof of concept\n\nAgainst `amqp-client` 5.36.0 from Maven Central:\n\n```java\nimport com.rabbitmq.tools.jsonrpc.DefaultJsonRpcMapper;\n\npublic class Poc {\n    public static void main(String[] args) {\n        DefaultJsonRpcMapper mapper = new DefaultJsonRpcMapper();\n        mapper.parse(\"{\\\"method\\\":\\\"x\", String.class); // unterminated string\n        // mapper.parse(\"//\", String.class);           // unterminated // comment\n        System.out.println(\"unreachable\");\n    }\n}\n```\n\n`java -Xmx64m -cp amqp-client-5.36.0.jar:. Poc` throws `OutOfMemoryError: Java heap space` in about 0.1s and never prints. Swapping in the `//` line spins at 100% CPU and never returns. A well-formed body such as `{\"method\":\"x\"}` returns immediately.\n\n## Impact\n\nAvailability. One small, unauthenticated message stops a JSON-RPC endpoint: the unterminated string exhausts the heap, the unterminated comment pins a thread forever. Neither is recoverable per request - `JsonRpcServer.doCall` only catches `ClassCastException`, and an `OutOfMemoryError` affects the whole process.\n\n## Scope and fix\n\nOnly applications using the JSON-RPC-over-AMQP tooling (`com.rabbitmq.tools.jsonrpc`) with the default `DefaultJsonRpcMapper` are affected. `DefaultJsonRpcMapper` and `JSONReader` are deprecated in favour of `JacksonJsonRpcMapper`, but both still ship and remain the default when no mapper is supplied. The fix is to stop both loops at `CharacterIterator.DONE`.","categories":["Libraries & packages"],"product":"com.rabbitmq:amqp-client","vendor":"rabbitmq","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","source_modified_at":"2026-10-07T20:42:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.rabbitmq:amqp-client"},"range":"<= 5.36.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106121","source_modified_at":"2026-10-06T18:32:46.845Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"rabbitmq-java-client","vendor":"rabbitmq","versions":[{"version":"< 5.36.1","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106121","source_modified_at":"2026-10-06T18:32:46.845Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"amqp-client","vendor":"com.rabbitmq","versions":[{"version":"< 5.36.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cqgh-8p3p-mx4m","source_modified_at":"2026-10-07T21:00:04.481305005Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"com.rabbitmq:amqp-client","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq/amqp-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.1"}]}],"versions":["1.3.0","1.5.4","1.5.5","1.6.0","1.7.2","1.8.0","1.8.1","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","source_modified_at":"2026-10-07T20:42:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.rabbitmq:amqp-client"},"version":"5.36.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cqgh-8p3p-mx4m","source_modified_at":"2026-10-07T21:00:04.481305005Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"com.rabbitmq:amqp-client","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq/amqp-client"},"version":"5.36.1"}],"cvss":4.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00501,"percentile":0.42031,"score_date":"2026-10-23"},"published_at":"2026-10-06T18:08:52.026Z","modified_at":"2026-10-07T21:00:04.481305005Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:42:34Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106121","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T18:32:46.845Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cqgh-8p3p-mx4m","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-07T21:00:04.481305005Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106121","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106121","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2100","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T18:32:40.985871Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T21:00:04.481305005Z","content_hash":"f32dd119b26be7f91704ffe8b588e3aa4e86dd4030b11a484cb41c737c57661d"}}